From 9aa8710ef2fdc8f46cf6ccd334d3a49810fa632c Mon Sep 17 00:00:00 2001 From: Myasnikov Daniil Date: Sun, 10 May 2026 17:40:55 +0500 Subject: [PATCH 01/28] feat(fluxcd): bump flux-operator/instance to v0.48.0, web UI opt-in MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bump flux-operator and flux-instance vendored charts from v0.33.0 to v0.48.0, moving the Flux distribution from 2.7.x to 2.8.x. This brings helm-controller v1.5.x, which exposes spec.install.healthCheckExprs on HelmRelease — a prerequisite for adding real readiness gating to dependency-target packages (postgres, mongodb, kafka, etc.). The new flux-operator chart defaults web.enabled=true; override it to false in packages/system/fluxcd-operator/values.yaml so the Flux Status Web UI stays opt-in. Operators wanting it can set web.enabled=true and configure web.config / web.configSecretName / web.ingress per the upstream chart values. Patches reapplied: - kubernetesEnvs.diff: matched cleanly (offset shift only) - networkPolicy.diff: extended to also restrict port 9080 (web UI port); hunk count updated 20 -> 22 Pre-flight: no references to the v0.39-removed --disable-wait-interruption flag anywhere in packages/ or internal/. Verified locally: - helm template renders both packages without errors - web.enabled=false (default): no web Deployment/Service/NetworkPolicy - web.enabled=true: renders web NetworkPolicy on port 9080 - CiliumClusterwideNetworkPolicy lists 8080/8081/9080 - FluxInstance distribution.version: "2.8.x", all 7 components present - Cozystack kustomize patches (concurrent, requeue, storage-adv-addr, events-addr) intact Notable upstream changes between v0.33 and v0.48: - Flux 2.8.x with HelmRelease inventory format change (auto-migrated) - Reliability fixes for stuck FluxInstance/ResourceSet on health-check cancellation (v0.39, v0.46) - New CLI: flux-operator migrate, diff, patch instance, distro mirror - ResourceSetInputProvider: GitLab Environments, GitHub App, Gitea/Forgejo - CVE-2026-23990 (Web UI OIDC impersonation bypass) — N/A while web is off Assisted-By: Claude Signed-off-by: Myasnikov Daniil --- .../charts/flux-operator/Chart.yaml | 8 +- .../charts/flux-operator/README.md | 38 ++++- .../charts/flux-operator/templates/NOTES.txt | 2 +- .../flux-operator/templates/_helpers.tpl | 60 ++++++++ .../templates/admin-clusterrole.yaml | 2 +- .../templates/aggregate-clusterrole.yaml | 2 +- .../charts/flux-operator/templates/crds.yaml | 80 +++++++++-- .../flux-operator/templates/deployment.yaml | 32 +++++ .../flux-operator/templates/httproute.yaml | 26 ++++ .../flux-operator/templates/ingress.yaml | 44 ++++++ .../templates/network-policy.yaml | 2 + .../templates/networkpolicy.yaml | 32 +++++ .../flux-operator/templates/service.yaml | 6 + .../templates/web-clusterrole.yaml | 47 +++++++ .../flux-operator/templates/web-secret.yaml | 26 ++++ .../templates/web-standard-roles.yaml | 131 ++++++++++++++++++ .../charts/flux-operator/values.schema.json | 109 +++++++++++++++ .../charts/flux-operator/values.yaml | 47 ++++++- .../patches/networkPolicy.diff | 4 +- packages/system/fluxcd-operator/values.yaml | 4 + .../fluxcd/charts/flux-instance/Chart.yaml | 8 +- .../fluxcd/charts/flux-instance/README.md | 22 +-- .../charts/flux-instance/templates/NOTES.txt | 2 +- .../flux-instance/templates/healthcheck.yaml | 1 + .../flux-instance/templates/instance.yaml | 5 +- .../charts/flux-instance/values.schema.json | 10 ++ .../fluxcd/charts/flux-instance/values.yaml | 17 +-- packages/system/fluxcd/values.yaml | 2 +- 28 files changed, 717 insertions(+), 52 deletions(-) create mode 100644 packages/system/fluxcd-operator/charts/flux-operator/templates/httproute.yaml create mode 100644 packages/system/fluxcd-operator/charts/flux-operator/templates/ingress.yaml create mode 100644 packages/system/fluxcd-operator/charts/flux-operator/templates/networkpolicy.yaml create mode 100644 packages/system/fluxcd-operator/charts/flux-operator/templates/web-clusterrole.yaml create mode 100644 packages/system/fluxcd-operator/charts/flux-operator/templates/web-secret.yaml create mode 100644 packages/system/fluxcd-operator/charts/flux-operator/templates/web-standard-roles.yaml diff --git a/packages/system/fluxcd-operator/charts/flux-operator/Chart.yaml b/packages/system/fluxcd-operator/charts/flux-operator/Chart.yaml index d59dedfa5..897216a17 100644 --- a/packages/system/fluxcd-operator/charts/flux-operator/Chart.yaml +++ b/packages/system/fluxcd-operator/charts/flux-operator/Chart.yaml @@ -2,15 +2,15 @@ annotations: artifacthub.io/license: AGPL-3.0 artifacthub.io/links: | - name: Documentation - url: https://fluxcd.control-plane.io/operator + url: https://fluxoperator.dev/docs - name: Chart Source url: https://github.com/controlplaneio-fluxcd/charts - name: Upstream Project url: https://github.com/controlplaneio-fluxcd/flux-operator apiVersion: v2 -appVersion: v0.33.0 +appVersion: v0.48.0 description: 'A Helm chart for deploying the Flux Operator. ' -home: https://github.com/controlplaneio-fluxcd +home: https://fluxoperator.dev icon: https://raw.githubusercontent.com/cncf/artwork/main/projects/flux/icon/color/flux-icon-color.png keywords: - flux @@ -25,4 +25,4 @@ sources: - https://github.com/controlplaneio-fluxcd/flux-operator - https://github.com/controlplaneio-fluxcd/charts type: application -version: 0.33.0 +version: 0.48.0 diff --git a/packages/system/fluxcd-operator/charts/flux-operator/README.md b/packages/system/fluxcd-operator/charts/flux-operator/README.md index 036fc534b..87a0fcd32 100644 --- a/packages/system/fluxcd-operator/charts/flux-operator/README.md +++ b/packages/system/fluxcd-operator/charts/flux-operator/README.md @@ -1,6 +1,6 @@ # flux-operator -![Version: 0.33.0](https://img.shields.io/badge/Version-0.33.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: v0.33.0](https://img.shields.io/badge/AppVersion-v0.33.0-informational?style=flat-square) +![Version: 0.48.0](https://img.shields.io/badge/Version-0.48.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: v0.48.0](https://img.shields.io/badge/AppVersion-v0.48.0-informational?style=flat-square) The [Flux Operator](https://github.com/controlplaneio-fluxcd/flux-operator) provides a declarative API for the installation and upgrade of CNCF [Flux](https://fluxcd.io) and the @@ -9,12 +9,15 @@ ControlPlane [enterprise distribution](https://control-plane.io/enterprise-for-f The operator automates the patching for hotfixes and CVEs affecting the Flux controllers container images and enables the configuration of multi-tenancy lockdown on Kubernetes and OpenShift clusters. +The operator comes with the Flux Status Page web UI exposed on port `9080` that allows users to visualize the +status of the Flux installation and monitor the GitOps delivery pipeline in real-time. + ## Prerequisites -- Kubernetes 1.22+ +- Kubernetes 1.30+ - Helm 3.8+ -## Installing the Chart +## Installing Flux Operator To install the operator in the `flux-system` namespace: @@ -25,8 +28,22 @@ helm install flux-operator oci://ghcr.io/controlplaneio-fluxcd/charts/flux-opera --wait ``` +## Installing the Flux Web UI as a Standalone Deployment + +You can install the Flux Status Web UI as a dedicated deployment in your Kubernetes cluster, +separate from the Flux Operator with: + +```console +helm install flux-web oci://ghcr.io/controlplaneio-fluxcd/charts/flux-operator \ + --namespace flux-system \ + --set fullnameOverride=flux-web \ + --set web.serverOnly=true \ + --set installCRDs=false \ + --wait +``` + To deploy the Flux controllers and to configure automated updates, -see the Flux Operator [documentation](https://fluxcd.control-plane.io/operator/). +see the Flux Operator [documentation](https://fluxoperator.dev/docs/). ## Values @@ -47,7 +64,7 @@ see the Flux Operator [documentation](https://fluxcd.control-plane.io/operator/) | livenessProbe | object | `{"httpGet":{"path":"/healthz","port":8081},"initialDelaySeconds":15,"periodSeconds":20}` | Container liveness probe settings. | | logLevel | string | `"info"` | Container logging level flag. | | marketplace | object | `{"account":"","license":"","type":""}` | Marketplace settings. | -| multitenancy | object | `{"defaultServiceAccount":"flux-operator","defaultWorkloadIdentityServiceAccount":"flux-operator","enabled":false,"enabledForWorkloadIdentity":false}` | Enable [multitenancy lockdown](https://fluxcd.control-plane.io/operator/resourceset/#role-based-access-control) for the ResourceSet APIs. | +| multitenancy | object | `{"defaultServiceAccount":"flux-operator","defaultWorkloadIdentityServiceAccount":"flux-operator","enabled":false,"enabledForWorkloadIdentity":false}` | Enable [multitenancy lockdown](https://fluxoperator.dev/docs/crd/resourceset/#role-based-access-control) for the ResourceSet APIs. | | nameOverride | string | `""` | | | nodeSelector | object | `{}` | Pod Node Selector settings. | | podSecurityContext | object | `{}` | Pod security context settings. | @@ -55,12 +72,21 @@ see the Flux Operator [documentation](https://fluxcd.control-plane.io/operator/) | rbac.create | bool | `true` | Grant the cluster-admin role to the flux-operator service account (required for the Flux Instance deployment). | | rbac.createAggregation | bool | `true` | Grant the Kubernetes view, edit and admin roles access to ResourceSet APIs. | | readinessProbe | object | `{"httpGet":{"path":"/readyz","port":8081},"initialDelaySeconds":5,"periodSeconds":10}` | Container readiness probe settings. | -| reporting | object | `{"interval":"5m"}` | Flux [reporting](https://fluxcd.control-plane.io/operator/fluxreport/) settings. | +| reporting | object | `{"interval":"5m"}` | Flux [reporting](https://fluxoperator.dev/docs/crd/fluxreport/) settings. | | resources | object | `{"limits":{"cpu":"2000m","memory":"1Gi"},"requests":{"cpu":"100m","memory":"64Mi"}}` | Container resources requests and limits settings. | | securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"readOnlyRootFilesystem":true,"runAsNonRoot":true,"seccompProfile":{"type":"RuntimeDefault"}}` | Container security context settings. The default is compliant with the pod security restricted profile. | | serviceAccount | object | `{"automount":true,"create":true,"name":""}` | Pod service account settings. The name of the service account defaults to the release name. | | serviceMonitor | object | `{"create":false,"interval":"60s","labels":{},"scrapeTimeout":"30s"}` | Prometheus Operator scraping settings. | | tolerations | list | `[]` | Pod tolerations settings. | +| web.config | object | `{}` | The spec of the [Web Config API](https://fluxoperator.dev/docs/web-ui/web-config-api/) | +| web.configSecretName | string | `""` | Reference to an existing Secret in the same namespace as the deployment containing the Web Config API. Should have the key `config.yaml`. | +| web.enabled | bool | `true` | Enable the [Flux Status web server](https://fluxoperator.dev/web-ui/) on port 9080. | +| web.httpRoute | object | `{"annotations":{},"enabled":false,"hostnames":[],"parentRefs":[]}` | Gateway API HTTPRoute settings for the Flux Status web interface. | +| web.ingress | object | `{"annotations":{},"className":"","enabled":false,"hosts":[],"tls":[]}` | Ingress settings for the Flux Status web interface. | +| web.networkPolicy | object | `{"create":true}` | Create a NetworkPolicy to allow access to the Flux Status web interface. | +| web.rbac | object | `{"createAggregation":false,"createRoles":true}` | Create standard roles for [user access management](https://fluxoperator.dev/docs/web-ui/user-management/). | +| web.serverOnly | bool | `false` | Run the Flux Status web server as a standalone deployment (requires a dedicated Helm release). | +| web.serverReplicas | int | `1` | Number of replicas for the Flux Status web server standalone deployment (only applicable if `web.serverOnly` is `true`). | ## Source Code diff --git a/packages/system/fluxcd-operator/charts/flux-operator/templates/NOTES.txt b/packages/system/fluxcd-operator/charts/flux-operator/templates/NOTES.txt index b09e5e529..9af8d113e 100644 --- a/packages/system/fluxcd-operator/charts/flux-operator/templates/NOTES.txt +++ b/packages/system/fluxcd-operator/charts/flux-operator/templates/NOTES.txt @@ -1 +1 @@ -Documentation at https://fluxcd.control-plane.io/operator/ +Documentation at https://fluxoperator.dev/docs/ diff --git a/packages/system/fluxcd-operator/charts/flux-operator/templates/_helpers.tpl b/packages/system/fluxcd-operator/charts/flux-operator/templates/_helpers.tpl index 996d71d6e..ec6e44089 100644 --- a/packages/system/fluxcd-operator/charts/flux-operator/templates/_helpers.tpl +++ b/packages/system/fluxcd-operator/charts/flux-operator/templates/_helpers.tpl @@ -56,3 +56,63 @@ Create the name of the service account to use {{- define "flux-operator.serviceAccountName" -}} {{- default (include "flux-operator.fullname" .) .Values.serviceAccount.name }} {{- end }} + +{{/* +Check if web config secret should be created. +Returns "true" when web is enabled, config is provided inline, and no external secret is referenced. +*/}} +{{- define "flux-operator.createWebConfigSecret" -}} +{{- if and .Values.web.enabled .Values.web.config (not .Values.web.configSecretName) -}} +true +{{- end -}} +{{- end }} + +{{/* +Check if an external web config secret is referenced. +Returns "true" when web is enabled, an external secret name is provided, and no inline config is set. +*/}} +{{- define "flux-operator.useWebConfigSecret" -}} +{{- if and .Values.web.enabled .Values.web.configSecretName (not .Values.web.config) -}} +true +{{- end -}} +{{- end }} + +{{/* +Check if running in web server only mode. +Returns "true" when web is enabled and serverOnly mode is set. +*/}} +{{- define "flux-operator.webServerOnly" -}} +{{- if and .Values.web.enabled .Values.web.serverOnly -}} +true +{{- end -}} +{{- end }} + +{{/* +Check if web server replicas should be set. +Returns "true" when web is enabled, serverOnly mode is set, and serverReplicas is greater than 1. +*/}} +{{- define "flux-operator.setWebServerReplicas" -}} +{{- if and .Values.web.enabled .Values.web.serverOnly (gt (int .Values.web.serverReplicas) 1) -}} +true +{{- end -}} +{{- end }} + +{{/* +Check if web roles should be created. +Returns "true" when web is enabled and createRoles is enabled. +*/}} +{{- define "flux-operator.createWebRoles" -}} +{{- if and .Values.web.enabled .Values.web.rbac.createRoles -}} +true +{{- end -}} +{{- end }} + +{{/* +Check if web roles aggregation should be created. +Returns "true" when web is enabled and createAggregation is enabled. +*/}} +{{- define "flux-operator.createWebRolesAggregation" -}} +{{- if and .Values.web.enabled .Values.web.rbac.createAggregation -}} +true +{{- end -}} +{{- end }} diff --git a/packages/system/fluxcd-operator/charts/flux-operator/templates/admin-clusterrole.yaml b/packages/system/fluxcd-operator/charts/flux-operator/templates/admin-clusterrole.yaml index abbf8990a..2e5f17bfc 100644 --- a/packages/system/fluxcd-operator/charts/flux-operator/templates/admin-clusterrole.yaml +++ b/packages/system/fluxcd-operator/charts/flux-operator/templates/admin-clusterrole.yaml @@ -1,4 +1,4 @@ -{{- if .Values.rbac.create }} +{{- if and .Values.rbac.create (not (include "flux-operator.webServerOnly" .)) }} apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: diff --git a/packages/system/fluxcd-operator/charts/flux-operator/templates/aggregate-clusterrole.yaml b/packages/system/fluxcd-operator/charts/flux-operator/templates/aggregate-clusterrole.yaml index 86e9ba3f9..42c2cfee1 100644 --- a/packages/system/fluxcd-operator/charts/flux-operator/templates/aggregate-clusterrole.yaml +++ b/packages/system/fluxcd-operator/charts/flux-operator/templates/aggregate-clusterrole.yaml @@ -1,4 +1,4 @@ -{{- if .Values.rbac.createAggregation }} +{{- if and .Values.rbac.createAggregation (not (include "flux-operator.webServerOnly" .)) }} apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: diff --git a/packages/system/fluxcd-operator/charts/flux-operator/templates/crds.yaml b/packages/system/fluxcd-operator/charts/flux-operator/templates/crds.yaml index fdd6fe76c..4549c3626 100644 --- a/packages/system/fluxcd-operator/charts/flux-operator/templates/crds.yaml +++ b/packages/system/fluxcd-operator/charts/flux-operator/templates/crds.yaml @@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.19.0 + controller-gen.kubebuilder.io/version: v0.20.0 helm.sh/resource-policy: keep labels: app.kubernetes.io/instance: '{{ .Release.Name }}' @@ -164,7 +164,11 @@ spec: components: description: |- Components is the list of controllers to install. - Defaults to a commonly used subset. + Defaults to the core Flux controllers: + - source-controller + - kustomize-controller + - helm-controller + - notification-controller items: description: Component is the name of a controller to install. enum: @@ -211,6 +215,7 @@ spec: - upstream-alpine - enterprise-alpine - enterprise-distroless + - enterprise-distroless-fips type: string version: description: Version semver expression e.g. '2.x', '2.3.x'. @@ -618,7 +623,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.19.0 + controller-gen.kubebuilder.io/version: v0.20.0 helm.sh/resource-policy: keep labels: app.kubernetes.io/instance: '{{ .Release.Name }}' @@ -785,7 +790,7 @@ spec: failing: description: |- Failing is the number of reconciled - resources in the Failing state. + resources in the Failing state and not Suspended. type: integer running: description: |- @@ -921,7 +926,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.19.0 + controller-gen.kubebuilder.io/version: v0.20.0 helm.sh/resource-policy: keep labels: app.kubernetes.io/instance: '{{ .Release.Name }}' @@ -985,9 +990,9 @@ spec: - a PEM-encoded CA certificate (`ca.crt`) - a PEM-encoded client certificate (`tls.crt`) and private key (`tls.key`) - When connecting to a Git or OCI provider that uses self-signed certificates, the CA certificate - must be set in the Secret under the 'ca.crt' key to establish the trust relationship. - When connecting to an OCI provider that supports client certificates (mTLS), the client certificate + When connecting to a Git, OCI, or ExternalService provider that uses self-signed certificates, + the CA certificate must be set in the Secret under the 'ca.crt' key to establish the trust relationship. + When connecting to a provider that supports client certificates (mTLS), the client certificate and private key must be set in the Secret under the 'tls.crt' and 'tls.key' keys, respectively. properties: name: @@ -1013,6 +1018,11 @@ spec: ExcludeBranch specifies the regular expression to filter the branches that the input provider should exclude. type: string + excludeEnvironment: + description: |- + ExcludeEnvironment specifies the regular expression to filter the environments + that the input provider should exclude. + type: string excludeTag: description: |- ExcludeTag specifies the regular expression to filter the tags @@ -1023,6 +1033,11 @@ spec: IncludeBranch specifies the regular expression to filter the branches that the input provider should include. type: string + includeEnvironment: + description: |- + IncludeEnvironment specifies the regular expression to filter the environments + that the input provider should include. + type: string includeTag: description: |- IncludeTag specifies the regular expression to filter the tags @@ -1048,6 +1063,11 @@ spec: Supported only for tags at the moment. type: string type: object + insecure: + description: |- + Insecure allows connecting to an ExternalService or OCIArtifactTag provider + over plain HTTP without TLS. When not set, the URL must use HTTPS. + type: boolean schedule: description: Schedule defines the schedules for the input provider to run. @@ -1075,13 +1095,16 @@ spec: type: array secretRef: description: |- - SecretRef specifies the Kubernetes Secret containing the basic-auth credentials + SecretRef specifies the Kubernetes Secret containing the credentials to access the input provider. When connecting to a Git provider, the secret must contain the keys 'username' and 'password', and the password should be a personal access token that grants read-only access to the repository. When connecting to an OCI provider, the secret must contain a Kubernetes Image Pull Secret, as if created by `kubectl create secret docker-registry`. + When connecting to an ExternalService provider, the secret must contain either + a 'token' key for bearer token authentication, or 'username' and 'password' + keys for basic authentication. properties: name: description: Name of the referent. @@ -1119,13 +1142,18 @@ spec: - GitLabBranch - GitLabTag - GitLabMergeRequest + - GitLabEnvironment - AzureDevOpsBranch - AzureDevOpsTag - AzureDevOpsPullRequest + - GiteaBranch + - GiteaTag + - GiteaPullRequest - OCIArtifactTag - ACRArtifactTag - ECRArtifactTag - GARArtifactTag + - ExternalService type: string url: description: |- @@ -1151,6 +1179,16 @@ spec: - message: spec.url must start with 'oci://' when spec.type is an OCI provider rule: '!self.type.endsWith(''ArtifactTag'') || self.url.startsWith(''oci'')' + - message: spec.url must start with 'http://' or 'https://' when spec.type + is 'ExternalService' + rule: self.type != 'ExternalService' || self.url.startsWith('http') + - message: spec.insecure can only be set when spec.type is 'ExternalService' + or 'OCIArtifactTag' + rule: '!has(self.insecure) || !self.insecure || self.type == ''ExternalService'' + || self.type == ''OCIArtifactTag''' + - message: spec.url must use 'https://' unless spec.insecure is true + rule: self.type != 'ExternalService' || !self.url.startsWith('http://') + || (has(self.insecure) && self.insecure) - message: cannot specify spec.serviceAccountName when spec.type is not one of AzureDevOps* or *ArtifactTag rule: '!has(self.serviceAccountName) || self.type.startsWith(''AzureDevOps'') @@ -1289,7 +1327,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.19.0 + controller-gen.kubebuilder.io/version: v0.20.0 helm.sh/resource-policy: keep labels: app.kubernetes.io/instance: '{{ .Release.Name }}' @@ -1403,6 +1441,15 @@ spec: input provider objects are used. Defaults to flattening all inputs from all providers into a single list of input sets. properties: + includeEmptyProviders: + description: |- + IncludeEmptyProviders controls how input providers that export no + inputs are treated. Only applies when Name is Permute. When true, if + any provider has zero inputs the resulting permutation set is empty + (mathematically correct Cartesian product behavior). When false or + unset (default), providers with zero inputs are silently skipped and + the remaining providers still permute among themselves. + type: boolean name: description: |- Name defines how the inputs are combined when multiple @@ -1425,6 +1472,9 @@ spec: required: - name type: object + x-kubernetes-validations: + - message: includeEmptyProviders only applies when name is Permute + rule: '!has(self.includeEmptyProviders) || self.name == ''Permute''' inputs: description: Inputs contains the list of ResourceSet inputs. items: @@ -1603,6 +1653,16 @@ spec: - type type: object type: array + externalChecksumRefs: + description: |- + ExternalChecksumRefs lists the ConfigMap and Secret references + discovered in checksumFrom annotations on the last reconciliation + that point to objects not rendered by this ResourceSet. Each entry + has the form "Kind/namespace/name". It is used to trigger a + reconciliation when one of the referenced objects changes. + items: + type: string + type: array history: description: |- History contains the reconciliation history of the ResourceSet diff --git a/packages/system/fluxcd-operator/charts/flux-operator/templates/deployment.yaml b/packages/system/fluxcd-operator/charts/flux-operator/templates/deployment.yaml index cebc1cf10..e303ecf53 100644 --- a/packages/system/fluxcd-operator/charts/flux-operator/templates/deployment.yaml +++ b/packages/system/fluxcd-operator/charts/flux-operator/templates/deployment.yaml @@ -13,6 +13,9 @@ metadata: {{- toYaml . | nindent 4 }} {{- end }} spec: + {{- if include "flux-operator.setWebServerReplicas" . }} + replicas: {{ .Values.web.serverReplicas }} + {{- end }} selector: matchLabels: {{- include "flux-operator.selectorLabels" . | nindent 6 }} @@ -22,6 +25,9 @@ spec: prometheus.io/scrape: "true" prometheus.io/port: "8080" prometheus.io/path: "/metrics" + {{- if include "flux-operator.createWebConfigSecret" . }} + checksum/web-config: {{ (include (print $.Template.BasePath "/web-secret.yaml") . | fromYaml).stringData | toYaml | sha256sum }} + {{- end }} {{- with .Values.commonAnnotations }} {{- toYaml . | nindent 8 }} {{- end }} @@ -56,6 +62,15 @@ spec: {{- if .Values.multitenancy.enabledForWorkloadIdentity }} - --default-workload-identity-service-account={{ .Values.multitenancy.defaultWorkloadIdentityServiceAccount }} {{- end }} + {{- if include "flux-operator.webServerOnly" . }} + - --web-server-only=true + {{- end }} + {{- if include "flux-operator.createWebConfigSecret" . }} + - --web-config=/etc/flux-operator/web/config.yaml + {{- end }} + {{- if include "flux-operator.useWebConfigSecret" . }} + - --web-config-secret-name={{ .Values.web.configSecretName }} + {{- end }} {{- range .Values.extraArgs }} - {{ . }} {{- end }} @@ -66,6 +81,8 @@ spec: fieldPath: metadata.namespace - name: REPORTING_INTERVAL value: {{ .Values.reporting.interval }} + - name: WEB_SERVER_PORT + value: "{{ ternary "9080" "0" .Values.web.enabled }}" {{- with .Values.marketplace.type }} - name: MARKETPLACE_TYPE value: {{ . }} @@ -93,6 +110,11 @@ spec: - name: http containerPort: 8081 protocol: TCP + {{- if .Values.web.enabled }} + - name: http-web + containerPort: 9080 + protocol: TCP + {{- end }} livenessProbe: {{- toYaml .Values.livenessProbe | nindent 12 }} readinessProbe: @@ -102,12 +124,22 @@ spec: volumeMounts: - name: temp mountPath: /tmp + {{- if include "flux-operator.createWebConfigSecret" . }} + - name: web-config + mountPath: /etc/flux-operator/web + readOnly: true + {{- end }} {{- if .Values.extraVolumeMounts }} {{- toYaml .Values.extraVolumeMounts | nindent 12 }} {{- end }} volumes: - name: temp emptyDir: {} + {{- if include "flux-operator.createWebConfigSecret" . }} + - name: web-config + secret: + secretName: {{ include "flux-operator.fullname" . }}-web-config + {{- end }} {{- if .Values.extraVolumes }} {{- toYaml .Values.extraVolumes | nindent 8 }} {{- end }} diff --git a/packages/system/fluxcd-operator/charts/flux-operator/templates/httproute.yaml b/packages/system/fluxcd-operator/charts/flux-operator/templates/httproute.yaml new file mode 100644 index 000000000..1af8cadb5 --- /dev/null +++ b/packages/system/fluxcd-operator/charts/flux-operator/templates/httproute.yaml @@ -0,0 +1,26 @@ +{{- if .Values.web.httpRoute.enabled -}} +apiVersion: gateway.networking.k8s.io/v1 +kind: HTTPRoute +metadata: + name: {{ include "flux-operator.fullname" . }} + namespace: {{ .Release.Namespace }} + labels: + {{- include "flux-operator.labels" . | nindent 4 }} + {{- with .Values.web.httpRoute.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + {{- with .Values.web.httpRoute.parentRefs }} + parentRefs: + {{- toYaml . | nindent 4 }} + {{- end }} + {{- with .Values.web.httpRoute.hostnames }} + hostnames: + {{- toYaml . | nindent 4 }} + {{- end }} + rules: + - backendRefs: + - name: {{ include "flux-operator.fullname" . }} + port: 9080 +{{- end }} diff --git a/packages/system/fluxcd-operator/charts/flux-operator/templates/ingress.yaml b/packages/system/fluxcd-operator/charts/flux-operator/templates/ingress.yaml new file mode 100644 index 000000000..4f614ff92 --- /dev/null +++ b/packages/system/fluxcd-operator/charts/flux-operator/templates/ingress.yaml @@ -0,0 +1,44 @@ +{{- if .Values.web.ingress.enabled -}} +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: {{ include "flux-operator.fullname" . }} + namespace: {{ .Release.Namespace }} + labels: + {{- include "flux-operator.labels" . | nindent 4 }} + {{- with .Values.web.ingress.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + {{- with .Values.web.ingress.className }} + ingressClassName: {{ . }} + {{- end }} + {{- if .Values.web.ingress.tls }} + tls: + {{- range .Values.web.ingress.tls }} + - hosts: + {{- range .hosts }} + - {{ . | quote }} + {{- end }} + secretName: {{ .secretName }} + {{- end }} + {{- end }} + rules: + {{- range .Values.web.ingress.hosts }} + - host: {{ .host | quote }} + http: + paths: + {{- range .paths }} + - path: {{ .path }} + {{- with .pathType }} + pathType: {{ . }} + {{- end }} + backend: + service: + name: {{ include "flux-operator.fullname" $ }} + port: + name: http-web + {{- end }} + {{- end }} +{{- end }} diff --git a/packages/system/fluxcd-operator/charts/flux-operator/templates/network-policy.yaml b/packages/system/fluxcd-operator/charts/flux-operator/templates/network-policy.yaml index f97ddba38..2e7e6be79 100644 --- a/packages/system/fluxcd-operator/charts/flux-operator/templates/network-policy.yaml +++ b/packages/system/fluxcd-operator/charts/flux-operator/templates/network-policy.yaml @@ -14,6 +14,8 @@ spec: protocol: TCP - port: "8081" protocol: TCP + - port: "9080" + protocol: TCP ingress: - fromEntities: - cluster diff --git a/packages/system/fluxcd-operator/charts/flux-operator/templates/networkpolicy.yaml b/packages/system/fluxcd-operator/charts/flux-operator/templates/networkpolicy.yaml new file mode 100644 index 000000000..4c81bd10d --- /dev/null +++ b/packages/system/fluxcd-operator/charts/flux-operator/templates/networkpolicy.yaml @@ -0,0 +1,32 @@ +{{- if and .Values.web.enabled .Values.web.networkPolicy.create }} +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: {{ include "flux-operator.fullname" . }}-web + namespace: {{ .Release.Namespace }} + labels: + {{- include "flux-operator.labels" . | nindent 4 }} + {{- with .Values.commonLabels }} + {{- toYaml . | nindent 4 }} + {{- end }} + {{- with .Values.commonAnnotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + policyTypes: + - Ingress + podSelector: + matchLabels: + {{- include "flux-operator.selectorLabels" . | nindent 6 }} + ingress: + - from: + - namespaceSelector: {} + ports: + - protocol: TCP + port: 9080 + {{- if .Values.serviceMonitor.create }} + - protocol: TCP + port: 8080 + {{- end }} +{{- end }} diff --git a/packages/system/fluxcd-operator/charts/flux-operator/templates/service.yaml b/packages/system/fluxcd-operator/charts/flux-operator/templates/service.yaml index 37ad04c2f..a5c73ca5f 100644 --- a/packages/system/fluxcd-operator/charts/flux-operator/templates/service.yaml +++ b/packages/system/fluxcd-operator/charts/flux-operator/templates/service.yaml @@ -18,5 +18,11 @@ spec: targetPort: http-metrics protocol: TCP name: http + {{- if .Values.web.enabled }} + - port: 9080 + targetPort: http-web + protocol: TCP + name: http-web + {{- end }} selector: {{- include "flux-operator.selectorLabels" . | nindent 4 }} diff --git a/packages/system/fluxcd-operator/charts/flux-operator/templates/web-clusterrole.yaml b/packages/system/fluxcd-operator/charts/flux-operator/templates/web-clusterrole.yaml new file mode 100644 index 000000000..1cc312566 --- /dev/null +++ b/packages/system/fluxcd-operator/charts/flux-operator/templates/web-clusterrole.yaml @@ -0,0 +1,47 @@ +{{- if include "flux-operator.webServerOnly" . }} +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: {{ include "flux-operator.fullname" . }}-view + labels: + {{- include "flux-operator.labels" . | nindent 4 }} + {{- with .Values.commonLabels }} + {{- toYaml . | nindent 4 }} + {{- end }} + {{- with .Values.commonAnnotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +rules: + - apiGroups: ["*"] + resources: ["*"] + verbs: ["get", "list", "watch"] + - apiGroups: [""] + resources: ["events"] + verbs: ["create"] + - apiGroups: [""] + resources: ["users", "groups"] + verbs: ["impersonate"] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: {{ include "flux-operator.fullname" . }} + labels: + {{- include "flux-operator.labels" . | nindent 4 }} + {{- with .Values.commonLabels }} + {{- toYaml . | nindent 4 }} + {{- end }} + {{- with .Values.commonAnnotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: {{ include "flux-operator.fullname" . }}-view +subjects: + - kind: ServiceAccount + name: {{ include "flux-operator.serviceAccountName" . }} + namespace: {{ .Release.Namespace }} +{{- end }} diff --git a/packages/system/fluxcd-operator/charts/flux-operator/templates/web-secret.yaml b/packages/system/fluxcd-operator/charts/flux-operator/templates/web-secret.yaml new file mode 100644 index 000000000..c019f77c9 --- /dev/null +++ b/packages/system/fluxcd-operator/charts/flux-operator/templates/web-secret.yaml @@ -0,0 +1,26 @@ +{{- if and .Values.web.config .Values.web.configSecretName -}} +{{- fail "Invalid values: 'web.config' and 'web.configSecretName' cannot both be set. Set at most one." -}} +{{- end -}} +{{- if include "flux-operator.createWebConfigSecret" . -}} +apiVersion: v1 +kind: Secret +metadata: + name: {{ include "flux-operator.fullname" . }}-web-config + namespace: {{ .Release.Namespace }} + labels: + {{- include "flux-operator.labels" . | nindent 4 }} + {{- with .Values.commonLabels }} + {{- toYaml . | nindent 4 }} + {{- end }} + {{- with .Values.commonAnnotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +type: Opaque +stringData: + config.yaml: | + apiVersion: web.fluxcd.controlplane.io/v1 + kind: Config + spec: + {{- toYaml .Values.web.config | nindent 6 }} +{{- end }} diff --git a/packages/system/fluxcd-operator/charts/flux-operator/templates/web-standard-roles.yaml b/packages/system/fluxcd-operator/charts/flux-operator/templates/web-standard-roles.yaml new file mode 100644 index 000000000..085d1d6ac --- /dev/null +++ b/packages/system/fluxcd-operator/charts/flux-operator/templates/web-standard-roles.yaml @@ -0,0 +1,131 @@ +{{- if include "flux-operator.createWebRoles" . }} +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: flux-web-user + labels: + {{- include "flux-operator.labels" . | nindent 4 }} + {{- with .Values.commonLabels }} + {{- toYaml . | nindent 4 }} + {{- end }} + {{- with .Values.commonAnnotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +rules: + - apiGroups: ["*"] + resources: ["*"] + verbs: ["get", "list", "watch"] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: flux-web-admin + labels: + {{- include "flux-operator.labels" . | nindent 4 }} + {{- with .Values.commonLabels }} + {{- toYaml . | nindent 4 }} + {{- end }} + {{- with .Values.commonAnnotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +rules: + - apiGroups: ["*"] + resources: ["*"] + verbs: ["get", "list", "watch"] + - apiGroups: + - fluxcd.controlplane.io + - source.toolkit.fluxcd.io + - source.extensions.fluxcd.io + - kustomize.toolkit.fluxcd.io + - helm.toolkit.fluxcd.io + - image.toolkit.fluxcd.io + - notification.toolkit.fluxcd.io + resources: ["*"] + verbs: + - patch + - reconcile + - suspend + - resume + - download + - apiGroups: + - apps + resources: + - deployments + - statefulsets + - daemonsets + verbs: + - patch + - restart + - apiGroups: + - batch + resources: + - cronjobs + - jobs + verbs: + - create + - restart + - apiGroups: + - "" + resources: + - pods + verbs: + - delete +{{- end }} +{{- if include "flux-operator.createWebRolesAggregation" . }} +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: flux-web-edit + labels: + {{- include "flux-operator.labels" . | nindent 4 }} + {{- with .Values.commonLabels }} + {{- toYaml . | nindent 4 }} + {{- end }} + rbac.authorization.k8s.io/aggregate-to-edit: "true" + {{- with .Values.commonAnnotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +rules: + - apiGroups: + - fluxcd.controlplane.io + - source.toolkit.fluxcd.io + - source.extensions.fluxcd.io + - kustomize.toolkit.fluxcd.io + - helm.toolkit.fluxcd.io + - image.toolkit.fluxcd.io + - notification.toolkit.fluxcd.io + resources: + - '*' + verbs: + - reconcile + - suspend + - resume + - download + - apiGroups: + - apps + resources: + - deployments + - statefulsets + - daemonsets + verbs: + - patch + - restart + - apiGroups: + - batch + resources: + - cronjobs + - jobs + verbs: + - create + - restart + - apiGroups: + - "" + resources: + - pods + verbs: + - delete +{{- end }} diff --git a/packages/system/fluxcd-operator/charts/flux-operator/values.schema.json b/packages/system/fluxcd-operator/charts/flux-operator/values.schema.json index 6c42d4f84..17f4f2405 100644 --- a/packages/system/fluxcd-operator/charts/flux-operator/values.schema.json +++ b/packages/system/fluxcd-operator/charts/flux-operator/values.schema.json @@ -425,6 +425,115 @@ "items": { "type": "object" } + }, + "web": { + "type": "object", + "properties": { + "config": { + "type": "object" + }, + "configSecretName": { + "default": "", + "type": "string" + }, + "enabled": { + "type": "boolean" + }, + "httpRoute": { + "default": { + "annotations": {}, + "enabled": false, + "hostnames": [], + "parentRefs": [] + }, + "type": "object", + "properties": { + "annotations": { + "type": "object" + }, + "enabled": { + "default": false, + "type": "boolean" + }, + "hostnames": { + "type": "array", + "uniqueItems": true, + "items": { + "type": "string" + } + }, + "parentRefs": { + "type": "array", + "uniqueItems": true, + "items": { + "type": "object" + } + } + } + }, + "ingress": { + "default": { + "annotations": {}, + "className": "", + "enabled": false + }, + "type": "object", + "properties": { + "annotations": { + "type": "object" + }, + "className": { + "type": "string" + }, + "enabled": { + "default": false, + "type": "boolean" + }, + "hosts": { + "type": "array", + "uniqueItems": true, + "items": { + "type": "object" + } + }, + "tls": { + "type": "array", + "uniqueItems": true, + "items": { + "type": "object" + } + } + } + }, + "networkPolicy": { + "type": "object", + "properties": { + "create": { + "type": "boolean" + } + } + }, + "rbac": { + "type": "object", + "properties": { + "createAggregation": { + "default": false, + "type": "boolean" + }, + "createRoles": { + "default": true, + "type": "boolean" + } + } + }, + "serverOnly": { + "type": "boolean" + }, + "serverReplicas": { + "default": 1, + "type": "integer" + } + } } } } diff --git a/packages/system/fluxcd-operator/charts/flux-operator/values.yaml b/packages/system/fluxcd-operator/charts/flux-operator/values.yaml index aa2a6b59a..d10d6ea07 100644 --- a/packages/system/fluxcd-operator/charts/flux-operator/values.yaml +++ b/packages/system/fluxcd-operator/charts/flux-operator/values.yaml @@ -3,17 +3,60 @@ nameOverride: "" fullnameOverride: "" -# -- Enable [multitenancy lockdown](https://fluxcd.control-plane.io/operator/resourceset/#role-based-access-control) for the ResourceSet APIs. +# -- Enable [multitenancy lockdown](https://fluxoperator.dev/docs/crd/resourceset/#role-based-access-control) for the ResourceSet APIs. multitenancy: enabled: false enabledForWorkloadIdentity: false defaultServiceAccount: "flux-operator" # @schema required: true defaultWorkloadIdentityServiceAccount: "flux-operator" # @schema required: true -# -- Flux [reporting](https://fluxcd.control-plane.io/operator/fluxreport/) settings. +# -- Flux [reporting](https://fluxoperator.dev/docs/crd/fluxreport/) settings. reporting: interval: 5m # @schema required: true +web: + # -- Enable the [Flux Status web server](https://fluxoperator.dev/web-ui/) on port 9080. + enabled: true + # -- The spec of the [Web Config API](https://fluxoperator.dev/docs/web-ui/web-config-api/) + config: { } # @schema type: object + # -- Reference to an existing Secret in the same namespace as the deployment containing the Web Config API. Should have the key `config.yaml`. + configSecretName: "" # @schema default: "" + # -- Create a NetworkPolicy to allow access to the Flux Status web interface. + networkPolicy: + create: true + # -- Create standard roles for [user access management](https://fluxoperator.dev/docs/web-ui/user-management/). + rbac: + createRoles: true # @schema default: true + createAggregation: false # @schema default: false + # -- Run the Flux Status web server as a standalone deployment (requires a dedicated Helm release). + serverOnly: false + # -- Number of replicas for the Flux Status web server standalone deployment (only applicable if `web.serverOnly` is `true`). + serverReplicas: 1 # @schema default: 1 + # -- Ingress settings for the Flux Status web interface. + ingress: # @schema default: {"enabled":false,"className":"","annotations":{}} + enabled: false # @schema default: false + className: "" + annotations: { } # @schema type: object + hosts: [ ] # @schema item: object ; uniqueItems: true + # - host: flux-operator.example.com + # paths: + # - path: / + # pathType: ImplementationSpecific + tls: [ ] # @schema item: object ; uniqueItems: true + # - secretName: flux-operator-tls + # hosts: + # - flux-operator.example.com + # -- Gateway API HTTPRoute settings for the Flux Status web interface. + httpRoute: # @schema default: {"enabled":false,"annotations":{},"parentRefs":[],"hostnames":[]} + enabled: false # @schema default: false + annotations: { } # @schema type: object + parentRefs: [ ] # @schema item: object ; uniqueItems: true + # - name: my-gateway + # namespace: gateway-system + # sectionName: https + hostnames: [ ] # @schema item: string ; uniqueItems: true + # - flux.example.com + # -- Install and upgrade the custom resource definitions. installCRDs: true # @schema default: true diff --git a/packages/system/fluxcd-operator/patches/networkPolicy.diff b/packages/system/fluxcd-operator/patches/networkPolicy.diff index e074ae2f7..1c478de7f 100644 --- a/packages/system/fluxcd-operator/patches/networkPolicy.diff +++ b/packages/system/fluxcd-operator/patches/networkPolicy.diff @@ -2,7 +2,7 @@ diff --git a/charts/flux-operator/templates/network-policy.yaml b/packages/syste new file mode 100644 --- /dev/null (revision 52a23eacfc32430d8b008b765c64a81526521bae) +++ b/charts/flux-operator/templates/network-policy.yaml (revision 52a23eacfc32430d8b008b765c64a81526521bae) -@@ -0,0 +1,20 @@ +@@ -0,0 +1,22 @@ +{{- if .Capabilities.APIVersions.Has "cilium.io/v2/CiliumClusterwideNetworkPolicy" }} +apiVersion: cilium.io/v2 +kind: CiliumClusterwideNetworkPolicy @@ -19,6 +19,8 @@ new file mode 100644 + protocol: TCP + - port: "8081" + protocol: TCP ++ - port: "9080" ++ protocol: TCP + ingress: + - fromEntities: + - cluster diff --git a/packages/system/fluxcd-operator/values.yaml b/packages/system/fluxcd-operator/values.yaml index 9053689a0..793fea333 100644 --- a/packages/system/fluxcd-operator/values.yaml +++ b/packages/system/fluxcd-operator/values.yaml @@ -12,3 +12,7 @@ flux-operator: requests: cpu: 100m memory: 350Mi + # Flux Status Web UI is opt-in. Override `web.enabled: true` (and configure + # `web.config` / `web.configSecretName` / `web.ingress` as needed) to enable. + web: + enabled: false diff --git a/packages/system/fluxcd/charts/flux-instance/Chart.yaml b/packages/system/fluxcd/charts/flux-instance/Chart.yaml index 448e66005..9d1272ead 100644 --- a/packages/system/fluxcd/charts/flux-instance/Chart.yaml +++ b/packages/system/fluxcd/charts/flux-instance/Chart.yaml @@ -2,15 +2,15 @@ annotations: artifacthub.io/license: AGPL-3.0 artifacthub.io/links: | - name: Documentation - url: https://fluxcd.control-plane.io/operator + url: https://fluxoperator.dev/docs - name: Chart Source url: https://github.com/controlplaneio-fluxcd/charts - name: Upstream Project url: https://github.com/controlplaneio-fluxcd/flux-operator apiVersion: v2 -appVersion: v0.33.0 +appVersion: v0.48.0 description: 'A Helm chart for deploying a Flux instance managed by Flux Operator. ' -home: https://github.com/controlplaneio-fluxcd +home: https://fluxoperator.dev icon: https://raw.githubusercontent.com/cncf/artwork/main/projects/flux/icon/color/flux-icon-color.png keywords: - flux @@ -25,4 +25,4 @@ sources: - https://github.com/controlplaneio-fluxcd/flux-operator - https://github.com/controlplaneio-fluxcd/charts type: application -version: 0.33.0 +version: 0.48.0 diff --git a/packages/system/fluxcd/charts/flux-instance/README.md b/packages/system/fluxcd/charts/flux-instance/README.md index e788edf16..50b6139ab 100644 --- a/packages/system/fluxcd/charts/flux-instance/README.md +++ b/packages/system/fluxcd/charts/flux-instance/README.md @@ -1,6 +1,6 @@ # flux-instance -![Version: 0.33.0](https://img.shields.io/badge/Version-0.33.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: v0.33.0](https://img.shields.io/badge/AppVersion-v0.33.0-informational?style=flat-square) +![Version: 0.48.0](https://img.shields.io/badge/Version-0.48.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: v0.48.0](https://img.shields.io/badge/AppVersion-v0.48.0-informational?style=flat-square) This chart is a thin wrapper around the `FluxInstance` custom resource, which is used by the [Flux Operator](https://github.com/controlplaneio-fluxcd/flux-operator) @@ -8,7 +8,7 @@ to install, configure and automatically upgrade Flux. ## Prerequisites -- Kubernetes 1.22+ +- Kubernetes 1.30+ - Helm 3.8+ ## Installing the Chart @@ -20,7 +20,7 @@ helm -n flux-system install flux oci://ghcr.io/controlplaneio-fluxcd/charts/flux ``` For more information on the available configuration options, -see the [Flux Instance documentation](https://fluxcd.control-plane.io/operator/fluxinstance/). +see the [Flux Instance documentation](https://fluxoperator.dev/docs/crd/fluxinstance/). ## Uninstalling the Chart @@ -39,14 +39,14 @@ helm -n flux-system uninstall flux | fullnameOverride | string | `"flux"` | | | healthcheck.enabled | bool | `false` | Enable post-install and post-upgrade health checks. | | healthcheck.timeout | string | `"5m"` | Health check timeout in Go duration format. | -| instance.cluster | object | `{"domain":"cluster.local","multitenant":false,"networkPolicy":true,"size":"","tenantDefaultServiceAccount":"default","type":"kubernetes"}` | Cluster https://fluxcd.control-plane.io/operator/fluxinstance/#cluster-configuration | -| instance.commonMetadata | object | `{"annotations":{},"labels":{}}` | Common metadata https://fluxcd.control-plane.io/operator/fluxinstance/#common-metadata | -| instance.components | list | `["source-controller","kustomize-controller","helm-controller","notification-controller"]` | Components https://fluxcd.control-plane.io/operator/fluxinstance/#components-configuration | -| instance.distribution | object | `{"artifact":"oci://ghcr.io/controlplaneio-fluxcd/flux-operator-manifests:latest","artifactPullSecret":"","imagePullSecret":"","registry":"ghcr.io/fluxcd","version":"2.x"}` | Distribution https://fluxcd.control-plane.io/operator/fluxinstance/#distribution-configuration | -| instance.kustomize.patches | list | `[]` | Kustomize patches https://fluxcd.control-plane.io/operator/fluxinstance/#kustomize-patches | -| instance.sharding | object | `{"key":"sharding.fluxcd.io/key","shards":[]}` | Sharding https://fluxcd.control-plane.io/operator/fluxinstance/#sharding-configuration | -| instance.storage | object | `{"class":"","size":""}` | Storage https://fluxcd.control-plane.io/operator/fluxinstance/#storage-configuration | -| instance.sync | object | `{"interval":"1m","kind":"GitRepository","name":"","path":"","provider":"","pullSecret":"","ref":"","url":""}` | Sync https://fluxcd.control-plane.io/operator/fluxinstance/#sync-configuration | +| instance.cluster | object | `{"domain":"cluster.local","multitenant":false,"networkPolicy":true,"size":"","tenantDefaultServiceAccount":"default","type":"kubernetes"}` | Cluster https://fluxoperator.dev/docs/crd/fluxinstance/#cluster-configuration | +| instance.commonMetadata | object | `{"annotations":{},"labels":{}}` | Common metadata https://fluxoperator.dev/docs/crd/fluxinstance/#common-metadata | +| instance.components | list | `["source-controller","kustomize-controller","helm-controller","notification-controller"]` | Components https://fluxoperator.dev/docs/crd/fluxinstance/#components-configuration | +| instance.distribution | object | `{"artifact":"oci://ghcr.io/controlplaneio-fluxcd/flux-operator-manifests:latest","artifactPullSecret":"","imagePullSecret":"","registry":"ghcr.io/fluxcd","variant":"","version":"2.x"}` | Distribution https://fluxoperator.dev/docs/crd/fluxinstance/#distribution-configuration | +| instance.kustomize.patches | list | `[]` | Kustomize patches https://fluxoperator.dev/docs/crd/fluxinstance/#kustomize-patches | +| instance.sharding | object | `{"key":"sharding.fluxcd.io/key","shards":[]}` | Sharding https://fluxoperator.dev/docs/crd/fluxinstance/#sharding-configuration | +| instance.storage | object | `{"class":"","size":""}` | Storage https://fluxoperator.dev/docs/crd/fluxinstance/#storage-configuration | +| instance.sync | object | `{"interval":"1m","kind":"GitRepository","name":"","path":"","provider":"","pullSecret":"","ref":"","url":""}` | Sync https://fluxoperator.dev/docs/crd/fluxinstance/#sync-configuration | | nameOverride | string | `""` | | ## Source Code diff --git a/packages/system/fluxcd/charts/flux-instance/templates/NOTES.txt b/packages/system/fluxcd/charts/flux-instance/templates/NOTES.txt index b09e5e529..9af8d113e 100644 --- a/packages/system/fluxcd/charts/flux-instance/templates/NOTES.txt +++ b/packages/system/fluxcd/charts/flux-instance/templates/NOTES.txt @@ -1 +1 @@ -Documentation at https://fluxcd.control-plane.io/operator/ +Documentation at https://fluxoperator.dev/docs/ diff --git a/packages/system/fluxcd/charts/flux-instance/templates/healthcheck.yaml b/packages/system/fluxcd/charts/flux-instance/templates/healthcheck.yaml index 41329d827..254e8ae1d 100644 --- a/packages/system/fluxcd/charts/flux-instance/templates/healthcheck.yaml +++ b/packages/system/fluxcd/charts/flux-instance/templates/healthcheck.yaml @@ -3,6 +3,7 @@ apiVersion: batch/v1 kind: Job metadata: name: "{{ .Release.Name }}-healthcheck" + namespace: {{ .Release.Namespace }} labels: app.kubernetes.io/managed-by: {{ .Release.Service | quote }} app.kubernetes.io/instance: {{ .Release.Name | quote }} diff --git a/packages/system/fluxcd/charts/flux-instance/templates/instance.yaml b/packages/system/fluxcd/charts/flux-instance/templates/instance.yaml index 576888116..f1f58309e 100644 --- a/packages/system/fluxcd/charts/flux-instance/templates/instance.yaml +++ b/packages/system/fluxcd/charts/flux-instance/templates/instance.yaml @@ -14,7 +14,7 @@ metadata: {{- end }} spec: distribution: - version: {{ .Values.instance.distribution.version }} + version: {{ .Values.instance.distribution.version | quote }} registry: {{ .Values.instance.distribution.registry }} artifact: {{ .Values.instance.distribution.artifact }} {{- if .Values.instance.distribution.artifactPullSecret }} @@ -23,6 +23,9 @@ spec: {{- if .Values.instance.distribution.imagePullSecret }} imagePullSecret: {{ .Values.instance.distribution.imagePullSecret }} {{- end }} + {{- if .Values.instance.distribution.variant }} + variant: {{ .Values.instance.distribution.variant }} + {{- end }} components: {{ .Values.instance.components | toYaml | nindent 4 }} cluster: {{- range $key, $value := .Values.instance.cluster }} diff --git a/packages/system/fluxcd/charts/flux-instance/values.schema.json b/packages/system/fluxcd/charts/flux-instance/values.schema.json index af0e7b1a5..d6f6c3182 100644 --- a/packages/system/fluxcd/charts/flux-instance/values.schema.json +++ b/packages/system/fluxcd/charts/flux-instance/values.schema.json @@ -350,6 +350,16 @@ "registry": { "type": "string" }, + "variant": { + "type": "string", + "enum": [ + "", + "upstream-alpine", + "enterprise-alpine", + "enterprise-distroless", + "enterprise-distroless-fips" + ] + }, "version": { "type": "string" } diff --git a/packages/system/fluxcd/charts/flux-instance/values.yaml b/packages/system/fluxcd/charts/flux-instance/values.yaml index 84619eca2..84e16cb03 100644 --- a/packages/system/fluxcd/charts/flux-instance/values.yaml +++ b/packages/system/fluxcd/charts/flux-instance/values.yaml @@ -4,20 +4,21 @@ nameOverride: "" fullnameOverride: "flux" instance: - # -- Distribution https://fluxcd.control-plane.io/operator/fluxinstance/#distribution-configuration + # -- Distribution https://fluxoperator.dev/docs/crd/fluxinstance/#distribution-configuration distribution: # @schema required: true version: "2.x" # @schema required: true registry: "ghcr.io/fluxcd" # @schema required: true artifact: "oci://ghcr.io/controlplaneio-fluxcd/flux-operator-manifests:latest" artifactPullSecret: "" imagePullSecret: "" - # -- Components https://fluxcd.control-plane.io/operator/fluxinstance/#components-configuration + variant: "" # @schema enum:['',upstream-alpine,enterprise-alpine,enterprise-distroless,enterprise-distroless-fips] + # -- Components https://fluxoperator.dev/docs/crd/fluxinstance/#components-configuration components: # @schema item: string; uniqueItems: true; itemEnum: [source-controller,kustomize-controller,helm-controller,notification-controller,image-reflector-controller,image-automation-controller,source-watcher] - source-controller - kustomize-controller - helm-controller - notification-controller - # -- Cluster https://fluxcd.control-plane.io/operator/fluxinstance/#cluster-configuration + # -- Cluster https://fluxoperator.dev/docs/crd/fluxinstance/#cluster-configuration cluster: # @schema required: true type: kubernetes # @schema enum:[kubernetes,openshift,aws,azure,gcp] size: "" # @schema enum:['',small,medium,large] @@ -25,19 +26,19 @@ instance: networkPolicy: true multitenant: false tenantDefaultServiceAccount: "default" - # -- Common metadata https://fluxcd.control-plane.io/operator/fluxinstance/#common-metadata + # -- Common metadata https://fluxoperator.dev/docs/crd/fluxinstance/#common-metadata commonMetadata: # @schema required: false labels: { } annotations: { } - # -- Storage https://fluxcd.control-plane.io/operator/fluxinstance/#storage-configuration + # -- Storage https://fluxoperator.dev/docs/crd/fluxinstance/#storage-configuration storage: # @schema required: false class: "" size: "" - # -- Sharding https://fluxcd.control-plane.io/operator/fluxinstance/#sharding-configuration + # -- Sharding https://fluxoperator.dev/docs/crd/fluxinstance/#sharding-configuration sharding: # @schema required: false key: "sharding.fluxcd.io/key" shards: [ ] # @schema item: string - # -- Sync https://fluxcd.control-plane.io/operator/fluxinstance/#sync-configuration + # -- Sync https://fluxoperator.dev/docs/crd/fluxinstance/#sync-configuration sync: # @schema required: false interval: 1m kind: "GitRepository" # @schema enum:[GitRepository,OCIRepository,Bucket] @@ -48,7 +49,7 @@ instance: name: "" provider: "" kustomize: # @schema required: false - # -- Kustomize patches https://fluxcd.control-plane.io/operator/fluxinstance/#kustomize-patches + # -- Kustomize patches https://fluxoperator.dev/docs/crd/fluxinstance/#kustomize-patches patches: [ ] # @schema item: object # -- Common annotations to add to all deployed objects including pods. diff --git a/packages/system/fluxcd/values.yaml b/packages/system/fluxcd/values.yaml index 7f5af0ffb..7c019aea0 100644 --- a/packages/system/fluxcd/values.yaml +++ b/packages/system/fluxcd/values.yaml @@ -5,7 +5,7 @@ flux-instance: domain: cozy.local # -- default value is overriden in patches distribution: artifact: "" - version: 2.7.x + version: 2.8.x registry: ghcr.io/fluxcd components: - source-controller From d1ad59509d7882e8394240b23780f5a2ca5a037c Mon Sep 17 00:00:00 2001 From: Myasnikov Daniil Date: Sun, 10 May 2026 18:19:42 +0500 Subject: [PATCH 02/28] feat(flux): regenerate embedded management-cluster manifests for Flux 2.8.0 Re-render internal/fluxinstall/manifests/fluxcd.yaml via `make update` in packages/core/flux-aio (timoni bundle build against oci://ghcr.io/stefanprodan/modules/flux-aio at the latest tag) so the cozystack-operator binary embeds Flux 2.8.0 instead of 2.7.3. Auto-syncs the helm-controller image into fluxcd-tenants.yaml. Embedded versions now match the chart bump in the prior commit: flux: v2.7.3 -> v2.8.0 helm-controller: v1.4.3 -> v1.5.0 (enables healthCheckExprs) source-controller: v1.7.3 -> v1.8.0 kustomize-controller: v1.7.2 -> v1.8.0 notification-controller:v1.7.4 -> v1.8.0 source-watcher: v2.0.2 -> v2.1.0 Verified by rebuilding cmd/cozystack-operator and running `strings` on the binary -- the expected v1.5.0 / v1.8.0 / v2.1.0 image strings are now embedded in place of the v1.4.x / v1.7.x ones. Structure preserved: - single AIO Deployment named "flux" in namespace cozy-fluxcd - all 5 controllers + source-watcher as containers in one pod - custom tolerations from flux-aio.cue intact - Namespace pod-security label still "privileged" via the Makefile yq post-processing step Net diff is -3664 lines (mostly CRD schema simplification in 2.8). Assisted-By: Claude Signed-off-by: Myasnikov Daniil --- .../fluxinstall/manifests/fluxcd-tenants.yaml | 2 +- internal/fluxinstall/manifests/fluxcd.yaml | 4070 +---------------- 2 files changed, 204 insertions(+), 3868 deletions(-) diff --git a/internal/fluxinstall/manifests/fluxcd-tenants.yaml b/internal/fluxinstall/manifests/fluxcd-tenants.yaml index 077cf34c3..40ed5d7b2 100644 --- a/internal/fluxinstall/manifests/fluxcd-tenants.yaml +++ b/internal/fluxinstall/manifests/fluxcd-tenants.yaml @@ -56,7 +56,7 @@ spec: resource: limits.memory - name: TUF_ROOT value: /tmp/.sigstore - image: "ghcr.io/fluxcd/helm-controller:v1.4.3" + image: "ghcr.io/fluxcd/helm-controller:v1.5.0" imagePullPolicy: IfNotPresent livenessProbe: httpGet: diff --git a/internal/fluxinstall/manifests/fluxcd.yaml b/internal/fluxinstall/manifests/fluxcd.yaml index 803f52bbf..401614644 100644 --- a/internal/fluxinstall/manifests/fluxcd.yaml +++ b/internal/fluxinstall/manifests/fluxcd.yaml @@ -10,7 +10,7 @@ metadata: labels: app.kubernetes.io/name: flux app.kubernetes.io/part-of: flux - app.kubernetes.io/version: v2.7.3 + app.kubernetes.io/version: v2.8.0 name: alerts.notification.toolkit.fluxcd.io spec: group: notification.toolkit.fluxcd.io @@ -102,6 +102,8 @@ spec: - ImagePolicy - ImageUpdateAutomation - OCIRepository + - ArtifactGenerator + - ExternalArtifact type: string matchLabels: additionalProperties: @@ -315,6 +317,8 @@ spec: - ImagePolicy - ImageUpdateAutomation - OCIRepository + - ArtifactGenerator + - ExternalArtifact type: string matchLabels: additionalProperties: @@ -394,7 +398,7 @@ metadata: labels: app.kubernetes.io/name: flux app.kubernetes.io/part-of: flux - app.kubernetes.io/version: v2.7.3 + app.kubernetes.io/version: v2.8.0 name: artifactgenerators.source.extensions.fluxcd.io spec: group: source.extensions.fluxcd.io @@ -476,10 +480,14 @@ spec: Strategy specifies the copy strategy to use. 'Overwrite' will overwrite existing files in the destination. 'Merge' is for merging YAML files using Helm values merge strategy. + 'Extract' is for extracting the contents of tarball archives (.tar.gz, .tgz) + When using glob patterns, non-tarball files are silently skipped. For single file sources, + the file must be a tarball or an error is returned. Directories are not supported. If not specified, defaults to 'Overwrite'. enum: - Overwrite - Merge + - Extract type: string to: description: |- @@ -548,6 +556,8 @@ spec: - Bucket - GitRepository - OCIRepository + - HelmChart + - ExternalArtifact type: string name: description: Name of the source. @@ -686,7 +696,7 @@ metadata: labels: app.kubernetes.io/name: flux app.kubernetes.io/part-of: flux - app.kubernetes.io/version: v2.7.3 + app.kubernetes.io/version: v2.8.0 name: buckets.source.toolkit.fluxcd.io spec: group: source.toolkit.fluxcd.io @@ -1052,380 +1062,6 @@ spec: storage: true subresources: status: {} - - additionalPrinterColumns: - - jsonPath: .spec.endpoint - name: Endpoint - type: string - - jsonPath: .metadata.creationTimestamp - name: Age - type: date - - jsonPath: .status.conditions[?(@.type=="Ready")].status - name: Ready - type: string - - jsonPath: .status.conditions[?(@.type=="Ready")].message - name: Status - type: string - deprecated: true - deprecationWarning: v1beta2 Bucket is deprecated, upgrade to v1 - name: v1beta2 - schema: - openAPIV3Schema: - description: Bucket is the Schema for the buckets API. - properties: - apiVersion: - description: |- - APIVersion defines the versioned schema of this representation of an object. - Servers should convert recognized schemas to the latest internal value, and - may reject unrecognized values. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources - type: string - kind: - description: |- - Kind is a string value representing the REST resource this object represents. - Servers may infer this from the endpoint the client submits requests to. - Cannot be updated. - In CamelCase. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds - type: string - metadata: - type: object - spec: - description: |- - BucketSpec specifies the required configuration to produce an Artifact for - an object storage bucket. - properties: - accessFrom: - description: |- - AccessFrom specifies an Access Control List for allowing cross-namespace - references to this object. - NOTE: Not implemented, provisional as of https://github.com/fluxcd/flux2/pull/2092 - properties: - namespaceSelectors: - description: |- - NamespaceSelectors is the list of namespace selectors to which this ACL applies. - Items in this list are evaluated using a logical OR operation. - items: - description: |- - NamespaceSelector selects the namespaces to which this ACL applies. - An empty map of MatchLabels matches all namespaces in a cluster. - properties: - matchLabels: - additionalProperties: - type: string - description: |- - MatchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, whose key field is "key", the - operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - type: object - type: array - required: - - namespaceSelectors - type: object - bucketName: - description: BucketName is the name of the object storage bucket. - type: string - certSecretRef: - description: |- - CertSecretRef can be given the name of a Secret containing - either or both of - - - a PEM-encoded client certificate (`tls.crt`) and private - key (`tls.key`); - - a PEM-encoded CA certificate (`ca.crt`) - - and whichever are supplied, will be used for connecting to the - bucket. The client cert and key are useful if you are - authenticating with a certificate; the CA cert is useful if - you are using a self-signed server certificate. The Secret must - be of type `Opaque` or `kubernetes.io/tls`. - - This field is only supported for the `generic` provider. - properties: - name: - description: Name of the referent. - type: string - required: - - name - type: object - endpoint: - description: Endpoint is the object storage address the BucketName is located at. - type: string - ignore: - description: |- - Ignore overrides the set of excluded patterns in the .sourceignore format - (which is the same as .gitignore). If not provided, a default will be used, - consult the documentation for your version to find out what those are. - type: string - insecure: - description: Insecure allows connecting to a non-TLS HTTP Endpoint. - type: boolean - interval: - description: |- - Interval at which the Bucket Endpoint is checked for updates. - This interval is approximate and may be subject to jitter to ensure - efficient use of resources. - pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$ - type: string - prefix: - description: Prefix to use for server-side filtering of files in the Bucket. - type: string - provider: - default: generic - description: |- - Provider of the object storage bucket. - Defaults to 'generic', which expects an S3 (API) compatible object - storage. - enum: - - generic - - aws - - gcp - - azure - type: string - proxySecretRef: - description: |- - ProxySecretRef specifies the Secret containing the proxy configuration - to use while communicating with the Bucket server. - properties: - name: - description: Name of the referent. - type: string - required: - - name - type: object - region: - description: Region of the Endpoint where the BucketName is located in. - type: string - secretRef: - description: |- - SecretRef specifies the Secret containing authentication credentials - for the Bucket. - properties: - name: - description: Name of the referent. - type: string - required: - - name - type: object - sts: - description: |- - STS specifies the required configuration to use a Security Token - Service for fetching temporary credentials to authenticate in a - Bucket provider. - - This field is only supported for the `aws` and `generic` providers. - properties: - certSecretRef: - description: |- - CertSecretRef can be given the name of a Secret containing - either or both of - - - a PEM-encoded client certificate (`tls.crt`) and private - key (`tls.key`); - - a PEM-encoded CA certificate (`ca.crt`) - - and whichever are supplied, will be used for connecting to the - STS endpoint. The client cert and key are useful if you are - authenticating with a certificate; the CA cert is useful if - you are using a self-signed server certificate. The Secret must - be of type `Opaque` or `kubernetes.io/tls`. - - This field is only supported for the `ldap` provider. - properties: - name: - description: Name of the referent. - type: string - required: - - name - type: object - endpoint: - description: |- - Endpoint is the HTTP/S endpoint of the Security Token Service from - where temporary credentials will be fetched. - pattern: ^(http|https)://.*$ - type: string - provider: - description: Provider of the Security Token Service. - enum: - - aws - - ldap - type: string - secretRef: - description: |- - SecretRef specifies the Secret containing authentication credentials - for the STS endpoint. This Secret must contain the fields `username` - and `password` and is supported only for the `ldap` provider. - properties: - name: - description: Name of the referent. - type: string - required: - - name - type: object - required: - - endpoint - - provider - type: object - suspend: - description: |- - Suspend tells the controller to suspend the reconciliation of this - Bucket. - type: boolean - timeout: - default: 60s - description: Timeout for fetch operations, defaults to 60s. - pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m))+$ - type: string - required: - - bucketName - - endpoint - - interval - type: object - x-kubernetes-validations: - - message: STS configuration is only supported for the 'aws' and 'generic' Bucket providers - rule: self.provider == 'aws' || self.provider == 'generic' || !has(self.sts) - - message: '''aws'' is the only supported STS provider for the ''aws'' Bucket provider' - rule: self.provider != 'aws' || !has(self.sts) || self.sts.provider == 'aws' - - message: '''ldap'' is the only supported STS provider for the ''generic'' Bucket provider' - rule: self.provider != 'generic' || !has(self.sts) || self.sts.provider == 'ldap' - - message: spec.sts.secretRef is not required for the 'aws' STS provider - rule: '!has(self.sts) || self.sts.provider != ''aws'' || !has(self.sts.secretRef)' - - message: spec.sts.certSecretRef is not required for the 'aws' STS provider - rule: '!has(self.sts) || self.sts.provider != ''aws'' || !has(self.sts.certSecretRef)' - status: - default: - observedGeneration: -1 - description: BucketStatus records the observed state of a Bucket. - properties: - artifact: - description: Artifact represents the last successful Bucket reconciliation. - properties: - digest: - description: Digest is the digest of the file in the form of ':'. - pattern: ^[a-z0-9]+(?:[.+_-][a-z0-9]+)*:[a-zA-Z0-9=_-]+$ - type: string - lastUpdateTime: - description: |- - LastUpdateTime is the timestamp corresponding to the last update of the - Artifact. - format: date-time - type: string - metadata: - additionalProperties: - type: string - description: Metadata holds upstream information such as OCI annotations. - type: object - path: - description: |- - Path is the relative file path of the Artifact. It can be used to locate - the file in the root of the Artifact storage on the local file system of - the controller managing the Source. - type: string - revision: - description: |- - Revision is a human-readable identifier traceable in the origin source - system. It can be a Git commit SHA, Git tag, a Helm chart version, etc. - type: string - size: - description: Size is the number of bytes in the file. - format: int64 - type: integer - url: - description: |- - URL is the HTTP address of the Artifact as exposed by the controller - managing the Source. It can be used to retrieve the Artifact for - consumption, e.g. by another controller applying the Artifact contents. - type: string - required: - - digest - - lastUpdateTime - - path - - revision - - url - type: object - conditions: - description: Conditions holds the conditions for the Bucket. - items: - description: Condition contains details for one aspect of the current state of this API Resource. - properties: - lastTransitionTime: - description: |- - lastTransitionTime is the last time the condition transitioned from one status to another. - This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. - format: date-time - type: string - message: - description: |- - message is a human readable message indicating details about the transition. - This may be an empty string. - maxLength: 32768 - type: string - observedGeneration: - description: |- - observedGeneration represents the .metadata.generation that the condition was set based upon. - For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date - with respect to the current state of the instance. - format: int64 - minimum: 0 - type: integer - reason: - description: |- - reason contains a programmatic identifier indicating the reason for the condition's last transition. - Producers of specific condition types may define expected values and meanings for this field, - and whether the values are considered a guaranteed API. - The value should be a CamelCase string. - This field may not be empty. - maxLength: 1024 - minLength: 1 - pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ - type: string - status: - description: status of the condition, one of True, False, Unknown. - enum: - - "True" - - "False" - - Unknown - type: string - type: - description: type of condition in CamelCase or in foo.example.com/CamelCase. - maxLength: 316 - pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ - type: string - required: - - lastTransitionTime - - message - - reason - - status - - type - type: object - type: array - lastHandledReconcileAt: - description: |- - LastHandledReconcileAt holds the value of the most recent - reconcile request value, so a change of the annotation value - can be detected. - type: string - observedGeneration: - description: ObservedGeneration is the last observed generation of the Bucket object. - format: int64 - type: integer - observedIgnore: - description: |- - ObservedIgnore is the observed exclusion patterns used for constructing - the source artifact. - type: string - url: - description: |- - URL is the dynamic fetch link for the latest Artifact. - It is provided on a "best effort" basis, and using the precise - BucketStatus.Artifact data is recommended. - type: string - type: object - type: object - served: true - storage: false - subresources: - status: {} --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition @@ -1436,7 +1072,7 @@ metadata: labels: app.kubernetes.io/name: flux app.kubernetes.io/part-of: flux - app.kubernetes.io/version: v2.7.3 + app.kubernetes.io/version: v2.8.0 name: externalartifacts.source.toolkit.fluxcd.io spec: group: source.toolkit.fluxcd.io @@ -1628,7 +1264,7 @@ metadata: labels: app.kubernetes.io/name: flux app.kubernetes.io/part-of: flux - app.kubernetes.io/version: v2.7.3 + app.kubernetes.io/version: v2.8.0 name: gitrepositories.source.toolkit.fluxcd.io spec: group: source.toolkit.fluxcd.io @@ -2096,464 +1732,6 @@ spec: storage: true subresources: status: {} - - additionalPrinterColumns: - - jsonPath: .spec.url - name: URL - type: string - - jsonPath: .metadata.creationTimestamp - name: Age - type: date - - jsonPath: .status.conditions[?(@.type=="Ready")].status - name: Ready - type: string - - jsonPath: .status.conditions[?(@.type=="Ready")].message - name: Status - type: string - deprecated: true - deprecationWarning: v1beta2 GitRepository is deprecated, upgrade to v1 - name: v1beta2 - schema: - openAPIV3Schema: - description: GitRepository is the Schema for the gitrepositories API. - properties: - apiVersion: - description: |- - APIVersion defines the versioned schema of this representation of an object. - Servers should convert recognized schemas to the latest internal value, and - may reject unrecognized values. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources - type: string - kind: - description: |- - Kind is a string value representing the REST resource this object represents. - Servers may infer this from the endpoint the client submits requests to. - Cannot be updated. - In CamelCase. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds - type: string - metadata: - type: object - spec: - description: |- - GitRepositorySpec specifies the required configuration to produce an - Artifact for a Git repository. - properties: - accessFrom: - description: |- - AccessFrom specifies an Access Control List for allowing cross-namespace - references to this object. - NOTE: Not implemented, provisional as of https://github.com/fluxcd/flux2/pull/2092 - properties: - namespaceSelectors: - description: |- - NamespaceSelectors is the list of namespace selectors to which this ACL applies. - Items in this list are evaluated using a logical OR operation. - items: - description: |- - NamespaceSelector selects the namespaces to which this ACL applies. - An empty map of MatchLabels matches all namespaces in a cluster. - properties: - matchLabels: - additionalProperties: - type: string - description: |- - MatchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, whose key field is "key", the - operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - type: object - type: array - required: - - namespaceSelectors - type: object - gitImplementation: - default: go-git - description: |- - GitImplementation specifies which Git client library implementation to - use. Defaults to 'go-git', valid values are ('go-git', 'libgit2'). - Deprecated: gitImplementation is deprecated now that 'go-git' is the - only supported implementation. - enum: - - go-git - - libgit2 - type: string - ignore: - description: |- - Ignore overrides the set of excluded patterns in the .sourceignore format - (which is the same as .gitignore). If not provided, a default will be used, - consult the documentation for your version to find out what those are. - type: string - include: - description: |- - Include specifies a list of GitRepository resources which Artifacts - should be included in the Artifact produced for this GitRepository. - items: - description: |- - GitRepositoryInclude specifies a local reference to a GitRepository which - Artifact (sub-)contents must be included, and where they should be placed. - properties: - fromPath: - description: |- - FromPath specifies the path to copy contents from, defaults to the root - of the Artifact. - type: string - repository: - description: |- - GitRepositoryRef specifies the GitRepository which Artifact contents - must be included. - properties: - name: - description: Name of the referent. - type: string - required: - - name - type: object - toPath: - description: |- - ToPath specifies the path to copy contents to, defaults to the name of - the GitRepositoryRef. - type: string - required: - - repository - type: object - type: array - interval: - description: Interval at which to check the GitRepository for updates. - pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$ - type: string - recurseSubmodules: - description: |- - RecurseSubmodules enables the initialization of all submodules within - the GitRepository as cloned from the URL, using their default settings. - type: boolean - ref: - description: |- - Reference specifies the Git reference to resolve and monitor for - changes, defaults to the 'master' branch. - properties: - branch: - description: Branch to check out, defaults to 'master' if no other field is defined. - type: string - commit: - description: |- - Commit SHA to check out, takes precedence over all reference fields. - - This can be combined with Branch to shallow clone the branch, in which - the commit is expected to exist. - type: string - name: - description: |- - Name of the reference to check out; takes precedence over Branch, Tag and SemVer. - - It must be a valid Git reference: https://git-scm.com/docs/git-check-ref-format#_description - Examples: "refs/heads/main", "refs/tags/v0.1.0", "refs/pull/420/head", "refs/merge-requests/1/head" - type: string - semver: - description: SemVer tag expression to check out, takes precedence over Tag. - type: string - tag: - description: Tag to check out, takes precedence over Branch. - type: string - type: object - secretRef: - description: |- - SecretRef specifies the Secret containing authentication credentials for - the GitRepository. - For HTTPS repositories the Secret must contain 'username' and 'password' - fields for basic auth or 'bearerToken' field for token auth. - For SSH repositories the Secret must contain 'identity' - and 'known_hosts' fields. - properties: - name: - description: Name of the referent. - type: string - required: - - name - type: object - suspend: - description: |- - Suspend tells the controller to suspend the reconciliation of this - GitRepository. - type: boolean - timeout: - default: 60s - description: Timeout for Git operations like cloning, defaults to 60s. - pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m))+$ - type: string - url: - description: URL specifies the Git repository URL, it can be an HTTP/S or SSH address. - pattern: ^(http|https|ssh)://.*$ - type: string - verify: - description: |- - Verification specifies the configuration to verify the Git commit - signature(s). - properties: - mode: - description: Mode specifies what Git object should be verified, currently ('head'). - enum: - - head - type: string - secretRef: - description: |- - SecretRef specifies the Secret containing the public keys of trusted Git - authors. - properties: - name: - description: Name of the referent. - type: string - required: - - name - type: object - required: - - mode - - secretRef - type: object - required: - - interval - - url - type: object - status: - default: - observedGeneration: -1 - description: GitRepositoryStatus records the observed state of a Git repository. - properties: - artifact: - description: Artifact represents the last successful GitRepository reconciliation. - properties: - digest: - description: Digest is the digest of the file in the form of ':'. - pattern: ^[a-z0-9]+(?:[.+_-][a-z0-9]+)*:[a-zA-Z0-9=_-]+$ - type: string - lastUpdateTime: - description: |- - LastUpdateTime is the timestamp corresponding to the last update of the - Artifact. - format: date-time - type: string - metadata: - additionalProperties: - type: string - description: Metadata holds upstream information such as OCI annotations. - type: object - path: - description: |- - Path is the relative file path of the Artifact. It can be used to locate - the file in the root of the Artifact storage on the local file system of - the controller managing the Source. - type: string - revision: - description: |- - Revision is a human-readable identifier traceable in the origin source - system. It can be a Git commit SHA, Git tag, a Helm chart version, etc. - type: string - size: - description: Size is the number of bytes in the file. - format: int64 - type: integer - url: - description: |- - URL is the HTTP address of the Artifact as exposed by the controller - managing the Source. It can be used to retrieve the Artifact for - consumption, e.g. by another controller applying the Artifact contents. - type: string - required: - - digest - - lastUpdateTime - - path - - revision - - url - type: object - conditions: - description: Conditions holds the conditions for the GitRepository. - items: - description: Condition contains details for one aspect of the current state of this API Resource. - properties: - lastTransitionTime: - description: |- - lastTransitionTime is the last time the condition transitioned from one status to another. - This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. - format: date-time - type: string - message: - description: |- - message is a human readable message indicating details about the transition. - This may be an empty string. - maxLength: 32768 - type: string - observedGeneration: - description: |- - observedGeneration represents the .metadata.generation that the condition was set based upon. - For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date - with respect to the current state of the instance. - format: int64 - minimum: 0 - type: integer - reason: - description: |- - reason contains a programmatic identifier indicating the reason for the condition's last transition. - Producers of specific condition types may define expected values and meanings for this field, - and whether the values are considered a guaranteed API. - The value should be a CamelCase string. - This field may not be empty. - maxLength: 1024 - minLength: 1 - pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ - type: string - status: - description: status of the condition, one of True, False, Unknown. - enum: - - "True" - - "False" - - Unknown - type: string - type: - description: type of condition in CamelCase or in foo.example.com/CamelCase. - maxLength: 316 - pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ - type: string - required: - - lastTransitionTime - - message - - reason - - status - - type - type: object - type: array - contentConfigChecksum: - description: |- - ContentConfigChecksum is a checksum of all the configurations related to - the content of the source artifact: - - .spec.ignore - - .spec.recurseSubmodules - - .spec.included and the checksum of the included artifacts - observed in .status.observedGeneration version of the object. This can - be used to determine if the content of the included repository has - changed. - It has the format of `:`, for example: `sha256:`. - - Deprecated: Replaced with explicit fields for observed artifact content - config in the status. - type: string - includedArtifacts: - description: |- - IncludedArtifacts contains a list of the last successfully included - Artifacts as instructed by GitRepositorySpec.Include. - items: - description: Artifact represents the output of a Source reconciliation. - properties: - digest: - description: Digest is the digest of the file in the form of ':'. - pattern: ^[a-z0-9]+(?:[.+_-][a-z0-9]+)*:[a-zA-Z0-9=_-]+$ - type: string - lastUpdateTime: - description: |- - LastUpdateTime is the timestamp corresponding to the last update of the - Artifact. - format: date-time - type: string - metadata: - additionalProperties: - type: string - description: Metadata holds upstream information such as OCI annotations. - type: object - path: - description: |- - Path is the relative file path of the Artifact. It can be used to locate - the file in the root of the Artifact storage on the local file system of - the controller managing the Source. - type: string - revision: - description: |- - Revision is a human-readable identifier traceable in the origin source - system. It can be a Git commit SHA, Git tag, a Helm chart version, etc. - type: string - size: - description: Size is the number of bytes in the file. - format: int64 - type: integer - url: - description: |- - URL is the HTTP address of the Artifact as exposed by the controller - managing the Source. It can be used to retrieve the Artifact for - consumption, e.g. by another controller applying the Artifact contents. - type: string - required: - - digest - - lastUpdateTime - - path - - revision - - url - type: object - type: array - lastHandledReconcileAt: - description: |- - LastHandledReconcileAt holds the value of the most recent - reconcile request value, so a change of the annotation value - can be detected. - type: string - observedGeneration: - description: |- - ObservedGeneration is the last observed generation of the GitRepository - object. - format: int64 - type: integer - observedIgnore: - description: |- - ObservedIgnore is the observed exclusion patterns used for constructing - the source artifact. - type: string - observedInclude: - description: |- - ObservedInclude is the observed list of GitRepository resources used to - to produce the current Artifact. - items: - description: |- - GitRepositoryInclude specifies a local reference to a GitRepository which - Artifact (sub-)contents must be included, and where they should be placed. - properties: - fromPath: - description: |- - FromPath specifies the path to copy contents from, defaults to the root - of the Artifact. - type: string - repository: - description: |- - GitRepositoryRef specifies the GitRepository which Artifact contents - must be included. - properties: - name: - description: Name of the referent. - type: string - required: - - name - type: object - toPath: - description: |- - ToPath specifies the path to copy contents to, defaults to the name of - the GitRepositoryRef. - type: string - required: - - repository - type: object - type: array - observedRecurseSubmodules: - description: |- - ObservedRecurseSubmodules is the observed resource submodules - configuration used to produce the current Artifact. - type: boolean - url: - description: |- - URL is the dynamic fetch link for the latest Artifact. - It is provided on a "best effort" basis, and using the precise - GitRepositoryStatus.Artifact data is recommended. - type: string - type: object - type: object - served: true - storage: false - subresources: - status: {} --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition @@ -2564,7 +1742,7 @@ metadata: labels: app.kubernetes.io/name: flux app.kubernetes.io/part-of: flux - app.kubernetes.io/version: v2.7.3 + app.kubernetes.io/version: v2.8.0 name: helmcharts.source.toolkit.fluxcd.io spec: group: source.toolkit.fluxcd.io @@ -2757,6 +1935,9 @@ spec: - interval - sourceRef type: object + x-kubernetes-validations: + - message: spec.verify is only supported when spec.sourceRef.kind is 'HelmRepository' + rule: '!has(self.verify) || self.sourceRef.kind == ''HelmRepository''' status: default: observedGeneration: -1 @@ -2906,372 +2087,6 @@ spec: storage: true subresources: status: {} - - additionalPrinterColumns: - - jsonPath: .spec.chart - name: Chart - type: string - - jsonPath: .spec.version - name: Version - type: string - - jsonPath: .spec.sourceRef.kind - name: Source Kind - type: string - - jsonPath: .spec.sourceRef.name - name: Source Name - type: string - - jsonPath: .metadata.creationTimestamp - name: Age - type: date - - jsonPath: .status.conditions[?(@.type=="Ready")].status - name: Ready - type: string - - jsonPath: .status.conditions[?(@.type=="Ready")].message - name: Status - type: string - deprecated: true - deprecationWarning: v1beta2 HelmChart is deprecated, upgrade to v1 - name: v1beta2 - schema: - openAPIV3Schema: - description: HelmChart is the Schema for the helmcharts API. - properties: - apiVersion: - description: |- - APIVersion defines the versioned schema of this representation of an object. - Servers should convert recognized schemas to the latest internal value, and - may reject unrecognized values. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources - type: string - kind: - description: |- - Kind is a string value representing the REST resource this object represents. - Servers may infer this from the endpoint the client submits requests to. - Cannot be updated. - In CamelCase. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds - type: string - metadata: - type: object - spec: - description: HelmChartSpec specifies the desired state of a Helm chart. - properties: - accessFrom: - description: |- - AccessFrom specifies an Access Control List for allowing cross-namespace - references to this object. - NOTE: Not implemented, provisional as of https://github.com/fluxcd/flux2/pull/2092 - properties: - namespaceSelectors: - description: |- - NamespaceSelectors is the list of namespace selectors to which this ACL applies. - Items in this list are evaluated using a logical OR operation. - items: - description: |- - NamespaceSelector selects the namespaces to which this ACL applies. - An empty map of MatchLabels matches all namespaces in a cluster. - properties: - matchLabels: - additionalProperties: - type: string - description: |- - MatchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, whose key field is "key", the - operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - type: object - type: array - required: - - namespaceSelectors - type: object - chart: - description: |- - Chart is the name or path the Helm chart is available at in the - SourceRef. - type: string - ignoreMissingValuesFiles: - description: |- - IgnoreMissingValuesFiles controls whether to silently ignore missing values - files rather than failing. - type: boolean - interval: - description: |- - Interval at which the HelmChart SourceRef is checked for updates. - This interval is approximate and may be subject to jitter to ensure - efficient use of resources. - pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$ - type: string - reconcileStrategy: - default: ChartVersion - description: |- - ReconcileStrategy determines what enables the creation of a new artifact. - Valid values are ('ChartVersion', 'Revision'). - See the documentation of the values for an explanation on their behavior. - Defaults to ChartVersion when omitted. - enum: - - ChartVersion - - Revision - type: string - sourceRef: - description: SourceRef is the reference to the Source the chart is available at. - properties: - apiVersion: - description: APIVersion of the referent. - type: string - kind: - description: |- - Kind of the referent, valid values are ('HelmRepository', 'GitRepository', - 'Bucket'). - enum: - - HelmRepository - - GitRepository - - Bucket - type: string - name: - description: Name of the referent. - type: string - required: - - kind - - name - type: object - suspend: - description: |- - Suspend tells the controller to suspend the reconciliation of this - source. - type: boolean - valuesFile: - description: |- - ValuesFile is an alternative values file to use as the default chart - values, expected to be a relative path in the SourceRef. Deprecated in - favor of ValuesFiles, for backwards compatibility the file specified here - is merged before the ValuesFiles items. Ignored when omitted. - type: string - valuesFiles: - description: |- - ValuesFiles is an alternative list of values files to use as the chart - values (values.yaml is not included by default), expected to be a - relative path in the SourceRef. - Values files are merged in the order of this list with the last file - overriding the first. Ignored when omitted. - items: - type: string - type: array - verify: - description: |- - Verify contains the secret name containing the trusted public keys - used to verify the signature and specifies which provider to use to check - whether OCI image is authentic. - This field is only supported when using HelmRepository source with spec.type 'oci'. - Chart dependencies, which are not bundled in the umbrella chart artifact, are not verified. - properties: - matchOIDCIdentity: - description: |- - MatchOIDCIdentity specifies the identity matching criteria to use - while verifying an OCI artifact which was signed using Cosign keyless - signing. The artifact's identity is deemed to be verified if any of the - specified matchers match against the identity. - items: - description: |- - OIDCIdentityMatch specifies options for verifying the certificate identity, - i.e. the issuer and the subject of the certificate. - properties: - issuer: - description: |- - Issuer specifies the regex pattern to match against to verify - the OIDC issuer in the Fulcio certificate. The pattern must be a - valid Go regular expression. - type: string - subject: - description: |- - Subject specifies the regex pattern to match against to verify - the identity subject in the Fulcio certificate. The pattern must - be a valid Go regular expression. - type: string - required: - - issuer - - subject - type: object - type: array - provider: - default: cosign - description: Provider specifies the technology used to sign the OCI Artifact. - enum: - - cosign - - notation - type: string - secretRef: - description: |- - SecretRef specifies the Kubernetes Secret containing the - trusted public keys. - properties: - name: - description: Name of the referent. - type: string - required: - - name - type: object - required: - - provider - type: object - version: - default: '*' - description: |- - Version is the chart version semver expression, ignored for charts from - GitRepository and Bucket sources. Defaults to latest when omitted. - type: string - required: - - chart - - interval - - sourceRef - type: object - status: - default: - observedGeneration: -1 - description: HelmChartStatus records the observed state of the HelmChart. - properties: - artifact: - description: Artifact represents the output of the last successful reconciliation. - properties: - digest: - description: Digest is the digest of the file in the form of ':'. - pattern: ^[a-z0-9]+(?:[.+_-][a-z0-9]+)*:[a-zA-Z0-9=_-]+$ - type: string - lastUpdateTime: - description: |- - LastUpdateTime is the timestamp corresponding to the last update of the - Artifact. - format: date-time - type: string - metadata: - additionalProperties: - type: string - description: Metadata holds upstream information such as OCI annotations. - type: object - path: - description: |- - Path is the relative file path of the Artifact. It can be used to locate - the file in the root of the Artifact storage on the local file system of - the controller managing the Source. - type: string - revision: - description: |- - Revision is a human-readable identifier traceable in the origin source - system. It can be a Git commit SHA, Git tag, a Helm chart version, etc. - type: string - size: - description: Size is the number of bytes in the file. - format: int64 - type: integer - url: - description: |- - URL is the HTTP address of the Artifact as exposed by the controller - managing the Source. It can be used to retrieve the Artifact for - consumption, e.g. by another controller applying the Artifact contents. - type: string - required: - - digest - - lastUpdateTime - - path - - revision - - url - type: object - conditions: - description: Conditions holds the conditions for the HelmChart. - items: - description: Condition contains details for one aspect of the current state of this API Resource. - properties: - lastTransitionTime: - description: |- - lastTransitionTime is the last time the condition transitioned from one status to another. - This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. - format: date-time - type: string - message: - description: |- - message is a human readable message indicating details about the transition. - This may be an empty string. - maxLength: 32768 - type: string - observedGeneration: - description: |- - observedGeneration represents the .metadata.generation that the condition was set based upon. - For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date - with respect to the current state of the instance. - format: int64 - minimum: 0 - type: integer - reason: - description: |- - reason contains a programmatic identifier indicating the reason for the condition's last transition. - Producers of specific condition types may define expected values and meanings for this field, - and whether the values are considered a guaranteed API. - The value should be a CamelCase string. - This field may not be empty. - maxLength: 1024 - minLength: 1 - pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ - type: string - status: - description: status of the condition, one of True, False, Unknown. - enum: - - "True" - - "False" - - Unknown - type: string - type: - description: type of condition in CamelCase or in foo.example.com/CamelCase. - maxLength: 316 - pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ - type: string - required: - - lastTransitionTime - - message - - reason - - status - - type - type: object - type: array - lastHandledReconcileAt: - description: |- - LastHandledReconcileAt holds the value of the most recent - reconcile request value, so a change of the annotation value - can be detected. - type: string - observedChartName: - description: |- - ObservedChartName is the last observed chart name as specified by the - resolved chart reference. - type: string - observedGeneration: - description: |- - ObservedGeneration is the last observed generation of the HelmChart - object. - format: int64 - type: integer - observedSourceArtifactRevision: - description: |- - ObservedSourceArtifactRevision is the last observed Artifact.Revision - of the HelmChartSpec.SourceRef. - type: string - observedValuesFiles: - description: |- - ObservedValuesFiles are the observed value files of the last successful - reconciliation. - It matches the chart in the last successfully reconciled artifact. - items: - type: string - type: array - url: - description: |- - URL is the dynamic fetch link for the latest Artifact. - It is provided on a "best effort" basis, and using the precise - BucketStatus.Artifact data is recommended. - type: string - type: object - type: object - served: true - storage: false - subresources: - status: {} --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition @@ -3282,7 +2097,7 @@ metadata: labels: app.kubernetes.io/name: flux app.kubernetes.io/part-of: flux - app.kubernetes.io/version: v2.7.3 + app.kubernetes.io/version: v2.8.0 name: helmreleases.helm.toolkit.fluxcd.io spec: group: helm.toolkit.fluxcd.io @@ -3621,6 +2436,43 @@ spec: - disabled type: string type: object + healthCheckExprs: + description: |- + HealthCheckExprs is a list of healthcheck expressions for evaluating the + health of custom resources using Common Expression Language (CEL). + The expressions are evaluated only when the specific Helm action + taking place has wait enabled, i.e. DisableWait is false, and the + 'poller' WaitStrategy is used. + items: + description: CustomHealthCheck defines the health check for custom resources. + properties: + apiVersion: + description: APIVersion of the custom resource under evaluation. + type: string + current: + description: |- + Current is the CEL expression that determines if the status + of the custom resource has reached the desired state. + type: string + failed: + description: |- + Failed is the CEL expression that determines if the status + of the custom resource has failed to reach the desired state. + type: string + inProgress: + description: |- + InProgress is the CEL expression that determines if the status + of the custom resource has not yet reached the desired state. + type: string + kind: + description: Kind of the custom resource under evaluation. + type: string + required: + - apiVersion + - current + - kind + type: object + type: array install: description: Install holds the configuration for Helm install actions for this HelmRelease. properties: @@ -3709,6 +2561,11 @@ spec: Replace tells the Helm install action to re-use the 'ReleaseName', but only if that name is a deleted release which remains in the history. type: boolean + serverSideApply: + description: |- + ServerSideApply enables server-side apply for resources during install. + Defaults to true (or false when UseHelm3Defaults feature gate is enabled). + type: boolean skipCRDs: description: |- SkipCRDs tells the Helm install action to not install any CRDs. By default, @@ -3975,8 +2832,28 @@ spec: description: Force forces resource updates through a replacement strategy. type: boolean recreate: - description: Recreate performs pod restarts for the resource if applicable. + description: |- + Recreate performs pod restarts for any managed workloads. + + Deprecated: This behavior was deprecated in Helm 3: + - Deprecation: https://github.com/helm/helm/pull/6463 + - Removal: https://github.com/helm/helm/pull/31023 + After helm-controller was upgraded to the Helm 4 SDK, + this field is no longer functional and will print a + warning if set to true. It will also be removed in a + future release. type: boolean + serverSideApply: + description: |- + ServerSideApply enables server-side apply for resources during rollback. + Can be "enabled", "disabled", or "auto". + When "auto", server-side apply usage will be based on the release's previous usage. + Defaults to "auto". + enum: + - enabled + - disabled + - auto + type: string timeout: description: |- Timeout is the time to wait for any individual Kubernetes operation (like @@ -4185,6 +3062,17 @@ spec: - uninstall type: string type: object + serverSideApply: + description: |- + ServerSideApply enables server-side apply for resources during upgrade. + Can be "enabled", "disabled", or "auto". + When "auto", server-side apply usage will be based on the release's previous usage. + Defaults to "auto". + enum: + - enabled + - disabled + - auto + type: string strategy: description: |- Strategy defines the upgrade strategy to use for this HelmRelease. @@ -4268,6 +3156,26 @@ spec: - name type: object type: array + waitStrategy: + description: |- + WaitStrategy defines Helm's wait strategy for waiting for applied + resources to become ready. + properties: + name: + description: |- + Name is Helm's wait strategy for waiting for applied resources to + become ready. One of 'poller' or 'legacy'. The 'poller' strategy uses + kstatus to poll resource statuses, while the 'legacy' strategy uses + Helm v3's waiting logic. + Defaults to 'poller', or to 'legacy' when UseHelm3Defaults feature + gate is enabled. + enum: + - poller + - legacy + type: string + required: + - name + type: object required: - interval type: object @@ -4355,11 +3263,14 @@ spec: Snapshot captures a point-in-time copy of the status information for a Helm release, as managed by the controller. properties: + action: + description: Action is the action that resulted in this snapshot being created. + type: string apiVersion: description: |- APIVersion is the API version of the Snapshot. - Provisional: when the calculation method of the Digest field is changed, - this field will be used to distinguish between the old and new methods. + When the calculation method of the Digest field is changed, this + field will be used to distinguish between the old and new methods. type: string appVersion: description: AppVersion is the chart app version of the release object in storage. @@ -4451,6 +3362,32 @@ spec: state. It is reset after a successful reconciliation. format: int64 type: integer + inventory: + description: |- + Inventory contains the list of Kubernetes resource object references + that have been applied for this release. + properties: + entries: + description: Entries of Kubernetes resource object references. + items: + description: ResourceRef contains the information necessary to locate a resource within a cluster. + properties: + id: + description: |- + ID is the string representation of the Kubernetes resource object's metadata, + in the format '___'. + type: string + v: + description: Version is the API version of the Kubernetes resource object's kind. + type: string + required: + - id + - v + type: object + type: array + required: + - entries + type: object lastAttemptedConfigDigest: description: |- LastAttemptedConfigDigest is the digest for the config (better known as @@ -4550,1276 +3487,6 @@ spec: storage: true subresources: status: {} - - additionalPrinterColumns: - - jsonPath: .metadata.creationTimestamp - name: Age - type: date - - jsonPath: .status.conditions[?(@.type=="Ready")].status - name: Ready - type: string - - jsonPath: .status.conditions[?(@.type=="Ready")].message - name: Status - type: string - deprecated: true - deprecationWarning: v2beta2 HelmRelease is deprecated, upgrade to v2 - name: v2beta2 - schema: - openAPIV3Schema: - description: HelmRelease is the Schema for the helmreleases API - properties: - apiVersion: - description: |- - APIVersion defines the versioned schema of this representation of an object. - Servers should convert recognized schemas to the latest internal value, and - may reject unrecognized values. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources - type: string - kind: - description: |- - Kind is a string value representing the REST resource this object represents. - Servers may infer this from the endpoint the client submits requests to. - Cannot be updated. - In CamelCase. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds - type: string - metadata: - type: object - spec: - description: HelmReleaseSpec defines the desired state of a Helm release. - properties: - chart: - description: |- - Chart defines the template of the v1beta2.HelmChart that should be created - for this HelmRelease. - properties: - metadata: - description: ObjectMeta holds the template for metadata like labels and annotations. - properties: - annotations: - additionalProperties: - type: string - description: |- - Annotations is an unstructured key value map stored with a resource that may be - set by external tools to store and retrieve arbitrary metadata. They are not - queryable and should be preserved when modifying objects. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ - type: object - labels: - additionalProperties: - type: string - description: |- - Map of string keys and values that can be used to organize and categorize - (scope and select) objects. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ - type: object - type: object - spec: - description: Spec holds the template for the v1beta2.HelmChartSpec for this HelmRelease. - properties: - chart: - description: The name or path the Helm chart is available at in the SourceRef. - maxLength: 2048 - minLength: 1 - type: string - ignoreMissingValuesFiles: - description: IgnoreMissingValuesFiles controls whether to silently ignore missing values files rather than failing. - type: boolean - interval: - description: |- - Interval at which to check the v1.Source for updates. Defaults to - 'HelmReleaseSpec.Interval'. - pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$ - type: string - reconcileStrategy: - default: ChartVersion - description: |- - Determines what enables the creation of a new artifact. Valid values are - ('ChartVersion', 'Revision'). - See the documentation of the values for an explanation on their behavior. - Defaults to ChartVersion when omitted. - enum: - - ChartVersion - - Revision - type: string - sourceRef: - description: The name and namespace of the v1.Source the chart is available at. - properties: - apiVersion: - description: APIVersion of the referent. - type: string - kind: - description: Kind of the referent. - enum: - - HelmRepository - - GitRepository - - Bucket - type: string - name: - description: Name of the referent. - maxLength: 253 - minLength: 1 - type: string - namespace: - description: Namespace of the referent. - maxLength: 63 - minLength: 1 - type: string - required: - - kind - - name - type: object - valuesFile: - description: |- - Alternative values file to use as the default chart values, expected to - be a relative path in the SourceRef. Deprecated in favor of ValuesFiles, - for backwards compatibility the file defined here is merged before the - ValuesFiles items. Ignored when omitted. - type: string - valuesFiles: - description: |- - Alternative list of values files to use as the chart values (values.yaml - is not included by default), expected to be a relative path in the SourceRef. - Values files are merged in the order of this list with the last file overriding - the first. Ignored when omitted. - items: - type: string - type: array - verify: - description: |- - Verify contains the secret name containing the trusted public keys - used to verify the signature and specifies which provider to use to check - whether OCI image is authentic. - This field is only supported for OCI sources. - Chart dependencies, which are not bundled in the umbrella chart artifact, - are not verified. - properties: - provider: - default: cosign - description: Provider specifies the technology used to sign the OCI Helm chart. - enum: - - cosign - - notation - type: string - secretRef: - description: |- - SecretRef specifies the Kubernetes Secret containing the - trusted public keys. - properties: - name: - description: Name of the referent. - type: string - required: - - name - type: object - required: - - provider - type: object - version: - default: '*' - description: |- - Version semver expression, ignored for charts from v1beta2.GitRepository and - v1beta2.Bucket sources. Defaults to latest when omitted. - type: string - required: - - chart - - sourceRef - type: object - required: - - spec - type: object - chartRef: - description: |- - ChartRef holds a reference to a source controller resource containing the - Helm chart artifact. - - Note: this field is provisional to the v2 API, and not actively used - by v2beta2 HelmReleases. - properties: - apiVersion: - description: APIVersion of the referent. - type: string - kind: - description: Kind of the referent. - enum: - - OCIRepository - - HelmChart - type: string - name: - description: Name of the referent. - maxLength: 253 - minLength: 1 - type: string - namespace: - description: |- - Namespace of the referent, defaults to the namespace of the Kubernetes - resource object that contains the reference. - maxLength: 63 - minLength: 1 - type: string - required: - - kind - - name - type: object - dependsOn: - description: |- - DependsOn may contain a meta.NamespacedObjectReference slice with - references to HelmRelease resources that must be ready before this HelmRelease - can be reconciled. - items: - description: |- - NamespacedObjectReference contains enough information to locate the referenced Kubernetes resource object in any - namespace. - properties: - name: - description: Name of the referent. - type: string - namespace: - description: Namespace of the referent, when not specified it acts as LocalObjectReference. - type: string - required: - - name - type: object - type: array - driftDetection: - description: |- - DriftDetection holds the configuration for detecting and handling - differences between the manifest in the Helm storage and the resources - currently existing in the cluster. - properties: - ignore: - description: |- - Ignore contains a list of rules for specifying which changes to ignore - during diffing. - items: - description: |- - IgnoreRule defines a rule to selectively disregard specific changes during - the drift detection process. - properties: - paths: - description: |- - Paths is a list of JSON Pointer (RFC 6901) paths to be excluded from - consideration in a Kubernetes object. - items: - type: string - type: array - target: - description: |- - Target is a selector for specifying Kubernetes objects to which this - rule applies. - If Target is not set, the Paths will be ignored for all Kubernetes - objects within the manifest of the Helm release. - properties: - annotationSelector: - description: |- - AnnotationSelector is a string that follows the label selection expression - https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api - It matches with the resource annotations. - type: string - group: - description: |- - Group is the API group to select resources from. - Together with Version and Kind it is capable of unambiguously identifying and/or selecting resources. - https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md - type: string - kind: - description: |- - Kind of the API Group to select resources from. - Together with Group and Version it is capable of unambiguously - identifying and/or selecting resources. - https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md - type: string - labelSelector: - description: |- - LabelSelector is a string that follows the label selection expression - https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api - It matches with the resource labels. - type: string - name: - description: Name to match resources with. - type: string - namespace: - description: Namespace to select resources from. - type: string - version: - description: |- - Version of the API Group to select resources from. - Together with Group and Kind it is capable of unambiguously identifying and/or selecting resources. - https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md - type: string - type: object - required: - - paths - type: object - type: array - mode: - description: |- - Mode defines how differences should be handled between the Helm manifest - and the manifest currently applied to the cluster. - If not explicitly set, it defaults to DiffModeDisabled. - enum: - - enabled - - warn - - disabled - type: string - type: object - install: - description: Install holds the configuration for Helm install actions for this HelmRelease. - properties: - crds: - description: |- - CRDs upgrade CRDs from the Helm Chart's crds directory according - to the CRD upgrade policy provided here. Valid values are `Skip`, - `Create` or `CreateReplace`. Default is `Create` and if omitted - CRDs are installed but not updated. - - Skip: do neither install nor replace (update) any CRDs. - - Create: new CRDs are created, existing CRDs are neither updated nor deleted. - - CreateReplace: new CRDs are created, existing CRDs are updated (replaced) - but not deleted. - - By default, CRDs are applied (installed) during Helm install action. - With this option users can opt in to CRD replace existing CRDs on Helm - install actions, which is not (yet) natively supported by Helm. - https://helm.sh/docs/chart_best_practices/custom_resource_definitions. - enum: - - Skip - - Create - - CreateReplace - type: string - createNamespace: - description: |- - CreateNamespace tells the Helm install action to create the - HelmReleaseSpec.TargetNamespace if it does not exist yet. - On uninstall, the namespace will not be garbage collected. - type: boolean - disableHooks: - description: DisableHooks prevents hooks from running during the Helm install action. - type: boolean - disableOpenAPIValidation: - description: |- - DisableOpenAPIValidation prevents the Helm install action from validating - rendered templates against the Kubernetes OpenAPI Schema. - type: boolean - disableWait: - description: |- - DisableWait disables the waiting for resources to be ready after a Helm - install has been performed. - type: boolean - disableWaitForJobs: - description: |- - DisableWaitForJobs disables waiting for jobs to complete after a Helm - install has been performed. - type: boolean - remediation: - description: |- - Remediation holds the remediation configuration for when the Helm install - action for the HelmRelease fails. The default is to not perform any action. - properties: - ignoreTestFailures: - description: |- - IgnoreTestFailures tells the controller to skip remediation when the Helm - tests are run after an install action but fail. Defaults to - 'Test.IgnoreFailures'. - type: boolean - remediateLastFailure: - description: |- - RemediateLastFailure tells the controller to remediate the last failure, when - no retries remain. Defaults to 'false'. - type: boolean - retries: - description: |- - Retries is the number of retries that should be attempted on failures before - bailing. Remediation, using an uninstall, is performed between each attempt. - Defaults to '0', a negative integer equals to unlimited retries. - type: integer - type: object - replace: - description: |- - Replace tells the Helm install action to re-use the 'ReleaseName', but only - if that name is a deleted release which remains in the history. - type: boolean - skipCRDs: - description: |- - SkipCRDs tells the Helm install action to not install any CRDs. By default, - CRDs are installed if not already present. - - Deprecated use CRD policy (`crds`) attribute with value `Skip` instead. - type: boolean - timeout: - description: |- - Timeout is the time to wait for any individual Kubernetes operation (like - Jobs for hooks) during the performance of a Helm install action. Defaults to - 'HelmReleaseSpec.Timeout'. - pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$ - type: string - type: object - interval: - description: Interval at which to reconcile the Helm release. - pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$ - type: string - kubeConfig: - description: |- - KubeConfig for reconciling the HelmRelease on a remote cluster. - When used in combination with HelmReleaseSpec.ServiceAccountName, - forces the controller to act on behalf of that Service Account at the - target cluster. - If the --default-service-account flag is set, its value will be used as - a controller level fallback for when HelmReleaseSpec.ServiceAccountName - is empty. - properties: - configMapRef: - description: |- - ConfigMapRef holds an optional name of a ConfigMap that contains - the following keys: - - - `provider`: the provider to use. One of `aws`, `azure`, `gcp`, or - `generic`. Required. - - `cluster`: the fully qualified resource name of the Kubernetes - cluster in the cloud provider API. Not used by the `generic` - provider. Required when one of `address` or `ca.crt` is not set. - - `address`: the address of the Kubernetes API server. Required - for `generic`. For the other providers, if not specified, the - first address in the cluster resource will be used, and if - specified, it must match one of the addresses in the cluster - resource. - If audiences is not set, will be used as the audience for the - `generic` provider. - - `ca.crt`: the optional PEM-encoded CA certificate for the - Kubernetes API server. If not set, the controller will use the - CA certificate from the cluster resource. - - `audiences`: the optional audiences as a list of - line-break-separated strings for the Kubernetes ServiceAccount - token. Defaults to the `address` for the `generic` provider, or - to specific values for the other providers depending on the - provider. - - `serviceAccountName`: the optional name of the Kubernetes - ServiceAccount in the same namespace that should be used - for authentication. If not specified, the controller - ServiceAccount will be used. - - Mutually exclusive with SecretRef. - properties: - name: - description: Name of the referent. - type: string - required: - - name - type: object - secretRef: - description: |- - SecretRef holds an optional name of a secret that contains a key with - the kubeconfig file as the value. If no key is set, the key will default - to 'value'. Mutually exclusive with ConfigMapRef. - It is recommended that the kubeconfig is self-contained, and the secret - is regularly updated if credentials such as a cloud-access-token expire. - Cloud specific `cmd-path` auth helpers will not function without adding - binaries and credentials to the Pod that is responsible for reconciling - Kubernetes resources. Supported only for the generic provider. - properties: - key: - description: Key in the Secret, when not specified an implementation-specific default key is used. - type: string - name: - description: Name of the Secret. - type: string - required: - - name - type: object - type: object - x-kubernetes-validations: - - message: exactly one of spec.kubeConfig.configMapRef or spec.kubeConfig.secretRef must be specified - rule: has(self.configMapRef) || has(self.secretRef) - - message: exactly one of spec.kubeConfig.configMapRef or spec.kubeConfig.secretRef must be specified - rule: '!has(self.configMapRef) || !has(self.secretRef)' - maxHistory: - description: |- - MaxHistory is the number of revisions saved by Helm for this HelmRelease. - Use '0' for an unlimited number of revisions; defaults to '5'. - type: integer - persistentClient: - description: |- - PersistentClient tells the controller to use a persistent Kubernetes - client for this release. When enabled, the client will be reused for the - duration of the reconciliation, instead of being created and destroyed - for each (step of a) Helm action. - - This can improve performance, but may cause issues with some Helm charts - that for example do create Custom Resource Definitions during installation - outside Helm's CRD lifecycle hooks, which are then not observed to be - available by e.g. post-install hooks. - - If not set, it defaults to true. - type: boolean - postRenderers: - description: |- - PostRenderers holds an array of Helm PostRenderers, which will be applied in order - of their definition. - items: - description: PostRenderer contains a Helm PostRenderer specification. - properties: - kustomize: - description: Kustomization to apply as PostRenderer. - properties: - images: - description: |- - Images is a list of (image name, new name, new tag or digest) - for changing image names, tags or digests. This can also be achieved with a - patch, but this operator is simpler to specify. - items: - description: Image contains an image name, a new name, a new tag or digest, which will replace the original name and tag. - properties: - digest: - description: |- - Digest is the value used to replace the original image tag. - If digest is present NewTag value is ignored. - type: string - name: - description: Name is a tag-less image name. - type: string - newName: - description: NewName is the value used to replace the original name. - type: string - newTag: - description: NewTag is the value used to replace the original tag. - type: string - required: - - name - type: object - type: array - patches: - description: |- - Strategic merge and JSON patches, defined as inline YAML objects, - capable of targeting objects based on kind, label and annotation selectors. - items: - description: |- - Patch contains an inline StrategicMerge or JSON6902 patch, and the target the patch should - be applied to. - properties: - patch: - description: |- - Patch contains an inline StrategicMerge patch or an inline JSON6902 patch with - an array of operation objects. - type: string - target: - description: Target points to the resources that the patch document should be applied to. - properties: - annotationSelector: - description: |- - AnnotationSelector is a string that follows the label selection expression - https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api - It matches with the resource annotations. - type: string - group: - description: |- - Group is the API group to select resources from. - Together with Version and Kind it is capable of unambiguously identifying and/or selecting resources. - https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md - type: string - kind: - description: |- - Kind of the API Group to select resources from. - Together with Group and Version it is capable of unambiguously - identifying and/or selecting resources. - https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md - type: string - labelSelector: - description: |- - LabelSelector is a string that follows the label selection expression - https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api - It matches with the resource labels. - type: string - name: - description: Name to match resources with. - type: string - namespace: - description: Namespace to select resources from. - type: string - version: - description: |- - Version of the API Group to select resources from. - Together with Group and Kind it is capable of unambiguously identifying and/or selecting resources. - https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md - type: string - type: object - required: - - patch - type: object - type: array - patchesJson6902: - description: |- - JSON 6902 patches, defined as inline YAML objects. - - Deprecated: use Patches instead. - items: - description: JSON6902Patch contains a JSON6902 patch and the target the patch should be applied to. - properties: - patch: - description: Patch contains the JSON6902 patch document with an array of operation objects. - items: - description: |- - JSON6902 is a JSON6902 operation object. - https://datatracker.ietf.org/doc/html/rfc6902#section-4 - properties: - from: - description: |- - From contains a JSON-pointer value that references a location within the target document where the operation is - performed. The meaning of the value depends on the value of Op, and is NOT taken into account by all operations. - type: string - op: - description: |- - Op indicates the operation to perform. Its value MUST be one of "add", "remove", "replace", "move", "copy", or - "test". - https://datatracker.ietf.org/doc/html/rfc6902#section-4 - enum: - - test - - remove - - add - - replace - - move - - copy - type: string - path: - description: |- - Path contains the JSON-pointer value that references a location within the target document where the operation - is performed. The meaning of the value depends on the value of Op. - type: string - value: - description: |- - Value contains a valid JSON structure. The meaning of the value depends on the value of Op, and is NOT taken into - account by all operations. - x-kubernetes-preserve-unknown-fields: true - required: - - op - - path - type: object - type: array - target: - description: Target points to the resources that the patch document should be applied to. - properties: - annotationSelector: - description: |- - AnnotationSelector is a string that follows the label selection expression - https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api - It matches with the resource annotations. - type: string - group: - description: |- - Group is the API group to select resources from. - Together with Version and Kind it is capable of unambiguously identifying and/or selecting resources. - https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md - type: string - kind: - description: |- - Kind of the API Group to select resources from. - Together with Group and Version it is capable of unambiguously - identifying and/or selecting resources. - https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md - type: string - labelSelector: - description: |- - LabelSelector is a string that follows the label selection expression - https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api - It matches with the resource labels. - type: string - name: - description: Name to match resources with. - type: string - namespace: - description: Namespace to select resources from. - type: string - version: - description: |- - Version of the API Group to select resources from. - Together with Group and Kind it is capable of unambiguously identifying and/or selecting resources. - https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md - type: string - type: object - required: - - patch - - target - type: object - type: array - patchesStrategicMerge: - description: |- - Strategic merge patches, defined as inline YAML objects. - - Deprecated: use Patches instead. - items: - x-kubernetes-preserve-unknown-fields: true - type: array - type: object - type: object - type: array - releaseName: - description: |- - ReleaseName used for the Helm release. Defaults to a composition of - '[TargetNamespace-]Name'. - maxLength: 53 - minLength: 1 - type: string - rollback: - description: Rollback holds the configuration for Helm rollback actions for this HelmRelease. - properties: - cleanupOnFail: - description: |- - CleanupOnFail allows deletion of new resources created during the Helm - rollback action when it fails. - type: boolean - disableHooks: - description: DisableHooks prevents hooks from running during the Helm rollback action. - type: boolean - disableWait: - description: |- - DisableWait disables the waiting for resources to be ready after a Helm - rollback has been performed. - type: boolean - disableWaitForJobs: - description: |- - DisableWaitForJobs disables waiting for jobs to complete after a Helm - rollback has been performed. - type: boolean - force: - description: Force forces resource updates through a replacement strategy. - type: boolean - recreate: - description: Recreate performs pod restarts for the resource if applicable. - type: boolean - timeout: - description: |- - Timeout is the time to wait for any individual Kubernetes operation (like - Jobs for hooks) during the performance of a Helm rollback action. Defaults to - 'HelmReleaseSpec.Timeout'. - pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$ - type: string - type: object - serviceAccountName: - description: |- - The name of the Kubernetes service account to impersonate - when reconciling this HelmRelease. - maxLength: 253 - minLength: 1 - type: string - storageNamespace: - description: |- - StorageNamespace used for the Helm storage. - Defaults to the namespace of the HelmRelease. - maxLength: 63 - minLength: 1 - type: string - suspend: - description: |- - Suspend tells the controller to suspend reconciliation for this HelmRelease, - it does not apply to already started reconciliations. Defaults to false. - type: boolean - targetNamespace: - description: |- - TargetNamespace to target when performing operations for the HelmRelease. - Defaults to the namespace of the HelmRelease. - maxLength: 63 - minLength: 1 - type: string - test: - description: Test holds the configuration for Helm test actions for this HelmRelease. - properties: - enable: - description: |- - Enable enables Helm test actions for this HelmRelease after an Helm install - or upgrade action has been performed. - type: boolean - filters: - description: Filters is a list of tests to run or exclude from running. - items: - description: Filter holds the configuration for individual Helm test filters. - properties: - exclude: - description: Exclude specifies whether the named test should be excluded. - type: boolean - name: - description: Name is the name of the test. - maxLength: 253 - minLength: 1 - type: string - required: - - name - type: object - type: array - ignoreFailures: - description: |- - IgnoreFailures tells the controller to skip remediation when the Helm tests - are run but fail. Can be overwritten for tests run after install or upgrade - actions in 'Install.IgnoreTestFailures' and 'Upgrade.IgnoreTestFailures'. - type: boolean - timeout: - description: |- - Timeout is the time to wait for any individual Kubernetes operation during - the performance of a Helm test action. Defaults to 'HelmReleaseSpec.Timeout'. - pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$ - type: string - type: object - timeout: - description: |- - Timeout is the time to wait for any individual Kubernetes operation (like Jobs - for hooks) during the performance of a Helm action. Defaults to '5m0s'. - pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$ - type: string - uninstall: - description: Uninstall holds the configuration for Helm uninstall actions for this HelmRelease. - properties: - deletionPropagation: - default: background - description: |- - DeletionPropagation specifies the deletion propagation policy when - a Helm uninstall is performed. - enum: - - background - - foreground - - orphan - type: string - disableHooks: - description: DisableHooks prevents hooks from running during the Helm rollback action. - type: boolean - disableWait: - description: |- - DisableWait disables waiting for all the resources to be deleted after - a Helm uninstall is performed. - type: boolean - keepHistory: - description: |- - KeepHistory tells Helm to remove all associated resources and mark the - release as deleted, but retain the release history. - type: boolean - timeout: - description: |- - Timeout is the time to wait for any individual Kubernetes operation (like - Jobs for hooks) during the performance of a Helm uninstall action. Defaults - to 'HelmReleaseSpec.Timeout'. - pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$ - type: string - type: object - upgrade: - description: Upgrade holds the configuration for Helm upgrade actions for this HelmRelease. - properties: - cleanupOnFail: - description: |- - CleanupOnFail allows deletion of new resources created during the Helm - upgrade action when it fails. - type: boolean - crds: - description: |- - CRDs upgrade CRDs from the Helm Chart's crds directory according - to the CRD upgrade policy provided here. Valid values are `Skip`, - `Create` or `CreateReplace`. Default is `Skip` and if omitted - CRDs are neither installed nor upgraded. - - Skip: do neither install nor replace (update) any CRDs. - - Create: new CRDs are created, existing CRDs are neither updated nor deleted. - - CreateReplace: new CRDs are created, existing CRDs are updated (replaced) - but not deleted. - - By default, CRDs are not applied during Helm upgrade action. With this - option users can opt-in to CRD upgrade, which is not (yet) natively supported by Helm. - https://helm.sh/docs/chart_best_practices/custom_resource_definitions. - enum: - - Skip - - Create - - CreateReplace - type: string - disableHooks: - description: DisableHooks prevents hooks from running during the Helm upgrade action. - type: boolean - disableOpenAPIValidation: - description: |- - DisableOpenAPIValidation prevents the Helm upgrade action from validating - rendered templates against the Kubernetes OpenAPI Schema. - type: boolean - disableWait: - description: |- - DisableWait disables the waiting for resources to be ready after a Helm - upgrade has been performed. - type: boolean - disableWaitForJobs: - description: |- - DisableWaitForJobs disables waiting for jobs to complete after a Helm - upgrade has been performed. - type: boolean - force: - description: Force forces resource updates through a replacement strategy. - type: boolean - preserveValues: - description: |- - PreserveValues will make Helm reuse the last release's values and merge in - overrides from 'Values'. Setting this flag makes the HelmRelease - non-declarative. - type: boolean - remediation: - description: |- - Remediation holds the remediation configuration for when the Helm upgrade - action for the HelmRelease fails. The default is to not perform any action. - properties: - ignoreTestFailures: - description: |- - IgnoreTestFailures tells the controller to skip remediation when the Helm - tests are run after an upgrade action but fail. - Defaults to 'Test.IgnoreFailures'. - type: boolean - remediateLastFailure: - description: |- - RemediateLastFailure tells the controller to remediate the last failure, when - no retries remain. Defaults to 'false' unless 'Retries' is greater than 0. - type: boolean - retries: - description: |- - Retries is the number of retries that should be attempted on failures before - bailing. Remediation, using 'Strategy', is performed between each attempt. - Defaults to '0', a negative integer equals to unlimited retries. - type: integer - strategy: - description: Strategy to use for failure remediation. Defaults to 'rollback'. - enum: - - rollback - - uninstall - type: string - type: object - timeout: - description: |- - Timeout is the time to wait for any individual Kubernetes operation (like - Jobs for hooks) during the performance of a Helm upgrade action. Defaults to - 'HelmReleaseSpec.Timeout'. - pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$ - type: string - type: object - values: - description: Values holds the values for this Helm release. - x-kubernetes-preserve-unknown-fields: true - valuesFrom: - description: |- - ValuesFrom holds references to resources containing Helm values for this HelmRelease, - and information about how they should be merged. - items: - description: |- - ValuesReference contains a reference to a resource containing Helm values, - and optionally the key they can be found at. - properties: - kind: - description: Kind of the values referent, valid values are ('Secret', 'ConfigMap'). - enum: - - Secret - - ConfigMap - type: string - name: - description: |- - Name of the values referent. Should reside in the same namespace as the - referring resource. - maxLength: 253 - minLength: 1 - type: string - optional: - description: |- - Optional marks this ValuesReference as optional. When set, a not found error - for the values reference is ignored, but any ValuesKey, TargetPath or - transient error will still result in a reconciliation failure. - type: boolean - targetPath: - description: |- - TargetPath is the YAML dot notation path the value should be merged at. When - set, the ValuesKey is expected to be a single flat value. Defaults to 'None', - which results in the values getting merged at the root. - maxLength: 250 - pattern: ^([a-zA-Z0-9_\-.\\\/]|\[[0-9]{1,5}\])+$ - type: string - valuesKey: - description: |- - ValuesKey is the data key where the values.yaml or a specific value can be - found at. Defaults to 'values.yaml'. - maxLength: 253 - pattern: ^[\-._a-zA-Z0-9]+$ - type: string - required: - - kind - - name - type: object - type: array - required: - - interval - type: object - x-kubernetes-validations: - - message: either chart or chartRef must be set - rule: (has(self.chart) && !has(self.chartRef)) || (!has(self.chart) && has(self.chartRef)) - status: - default: - observedGeneration: -1 - description: HelmReleaseStatus defines the observed state of a HelmRelease. - properties: - conditions: - description: Conditions holds the conditions for the HelmRelease. - items: - description: Condition contains details for one aspect of the current state of this API Resource. - properties: - lastTransitionTime: - description: |- - lastTransitionTime is the last time the condition transitioned from one status to another. - This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. - format: date-time - type: string - message: - description: |- - message is a human readable message indicating details about the transition. - This may be an empty string. - maxLength: 32768 - type: string - observedGeneration: - description: |- - observedGeneration represents the .metadata.generation that the condition was set based upon. - For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date - with respect to the current state of the instance. - format: int64 - minimum: 0 - type: integer - reason: - description: |- - reason contains a programmatic identifier indicating the reason for the condition's last transition. - Producers of specific condition types may define expected values and meanings for this field, - and whether the values are considered a guaranteed API. - The value should be a CamelCase string. - This field may not be empty. - maxLength: 1024 - minLength: 1 - pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ - type: string - status: - description: status of the condition, one of True, False, Unknown. - enum: - - "True" - - "False" - - Unknown - type: string - type: - description: type of condition in CamelCase or in foo.example.com/CamelCase. - maxLength: 316 - pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ - type: string - required: - - lastTransitionTime - - message - - reason - - status - - type - type: object - type: array - failures: - description: |- - Failures is the reconciliation failure count against the latest desired - state. It is reset after a successful reconciliation. - format: int64 - type: integer - helmChart: - description: |- - HelmChart is the namespaced name of the HelmChart resource created by - the controller for the HelmRelease. - type: string - history: - description: |- - History holds the history of Helm releases performed for this HelmRelease - up to the last successfully completed release. - items: - description: |- - Snapshot captures a point-in-time copy of the status information for a Helm release, - as managed by the controller. - properties: - apiVersion: - description: |- - APIVersion is the API version of the Snapshot. - Provisional: when the calculation method of the Digest field is changed, - this field will be used to distinguish between the old and new methods. - type: string - appVersion: - description: AppVersion is the chart app version of the release object in storage. - type: string - chartName: - description: ChartName is the chart name of the release object in storage. - type: string - chartVersion: - description: |- - ChartVersion is the chart version of the release object in - storage. - type: string - configDigest: - description: |- - ConfigDigest is the checksum of the config (better known as - "values") of the release object in storage. - It has the format of `:`. - type: string - deleted: - description: Deleted is when the release was deleted. - format: date-time - type: string - digest: - description: |- - Digest is the checksum of the release object in storage. - It has the format of `:`. - type: string - firstDeployed: - description: FirstDeployed is when the release was first deployed. - format: date-time - type: string - lastDeployed: - description: LastDeployed is when the release was last deployed. - format: date-time - type: string - name: - description: Name is the name of the release. - type: string - namespace: - description: Namespace is the namespace the release is deployed to. - type: string - ociDigest: - description: OCIDigest is the digest of the OCI artifact associated with the release. - type: string - status: - description: Status is the current state of the release. - type: string - testHooks: - additionalProperties: - description: |- - TestHookStatus holds the status information for a test hook as observed - to be run by the controller. - properties: - lastCompleted: - description: LastCompleted is the time the test hook last completed. - format: date-time - type: string - lastStarted: - description: LastStarted is the time the test hook was last started. - format: date-time - type: string - phase: - description: Phase the test hook was observed to be in. - type: string - type: object - description: |- - TestHooks is the list of test hooks for the release as observed to be - run by the controller. - type: object - version: - description: Version is the version of the release object in storage. - type: integer - required: - - chartName - - chartVersion - - configDigest - - digest - - firstDeployed - - lastDeployed - - name - - namespace - - status - - version - type: object - type: array - installFailures: - description: |- - InstallFailures is the install failure count against the latest desired - state. It is reset after a successful reconciliation. - format: int64 - type: integer - lastAppliedRevision: - description: |- - LastAppliedRevision is the revision of the last successfully applied - source. - - Deprecated: the revision can now be found in the History. - type: string - lastAttemptedConfigDigest: - description: |- - LastAttemptedConfigDigest is the digest for the config (better known as - "values") of the last reconciliation attempt. - type: string - lastAttemptedGeneration: - description: |- - LastAttemptedGeneration is the last generation the controller attempted - to reconcile. - format: int64 - type: integer - lastAttemptedReleaseAction: - description: |- - LastAttemptedReleaseAction is the last release action performed for this - HelmRelease. It is used to determine the active remediation strategy. - enum: - - install - - upgrade - type: string - lastAttemptedRevision: - description: |- - LastAttemptedRevision is the Source revision of the last reconciliation - attempt. For OCIRepository sources, the 12 first characters of the digest are - appended to the chart version e.g. "1.2.3+1234567890ab". - type: string - lastAttemptedRevisionDigest: - description: |- - LastAttemptedRevisionDigest is the digest of the last reconciliation attempt. - This is only set for OCIRepository sources. - type: string - lastAttemptedValuesChecksum: - description: |- - LastAttemptedValuesChecksum is the SHA1 checksum for the values of the last - reconciliation attempt. - - Deprecated: Use LastAttemptedConfigDigest instead. - type: string - lastHandledForceAt: - description: |- - LastHandledForceAt holds the value of the most recent force request - value, so a change of the annotation value can be detected. - type: string - lastHandledReconcileAt: - description: |- - LastHandledReconcileAt holds the value of the most recent - reconcile request value, so a change of the annotation value - can be detected. - type: string - lastHandledResetAt: - description: |- - LastHandledResetAt holds the value of the most recent reset request - value, so a change of the annotation value can be detected. - type: string - lastReleaseRevision: - description: |- - LastReleaseRevision is the revision of the last successful Helm release. - - Deprecated: Use History instead. - type: integer - observedGeneration: - description: ObservedGeneration is the last observed generation. - format: int64 - type: integer - observedPostRenderersDigest: - description: |- - ObservedPostRenderersDigest is the digest for the post-renderers of - the last successful reconciliation attempt. - type: string - storageNamespace: - description: |- - StorageNamespace is the namespace of the Helm release storage for the - current release. - maxLength: 63 - minLength: 1 - type: string - upgradeFailures: - description: |- - UpgradeFailures is the upgrade failure count against the latest desired - state. It is reset after a successful reconciliation. - format: int64 - type: integer - type: object - type: object - served: true - storage: false - subresources: - status: {} --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition @@ -5830,7 +3497,7 @@ metadata: labels: app.kubernetes.io/name: flux app.kubernetes.io/part-of: flux - app.kubernetes.io/version: v2.7.3 + app.kubernetes.io/version: v2.8.0 name: helmrepositories.source.toolkit.fluxcd.io spec: group: source.toolkit.fluxcd.io @@ -6144,309 +3811,6 @@ spec: storage: true subresources: status: {} - - additionalPrinterColumns: - - jsonPath: .spec.url - name: URL - type: string - - jsonPath: .metadata.creationTimestamp - name: Age - type: date - - jsonPath: .status.conditions[?(@.type=="Ready")].status - name: Ready - type: string - - jsonPath: .status.conditions[?(@.type=="Ready")].message - name: Status - type: string - deprecated: true - deprecationWarning: v1beta2 HelmRepository is deprecated, upgrade to v1 - name: v1beta2 - schema: - openAPIV3Schema: - description: HelmRepository is the Schema for the helmrepositories API. - properties: - apiVersion: - description: |- - APIVersion defines the versioned schema of this representation of an object. - Servers should convert recognized schemas to the latest internal value, and - may reject unrecognized values. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources - type: string - kind: - description: |- - Kind is a string value representing the REST resource this object represents. - Servers may infer this from the endpoint the client submits requests to. - Cannot be updated. - In CamelCase. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds - type: string - metadata: - type: object - spec: - description: |- - HelmRepositorySpec specifies the required configuration to produce an - Artifact for a Helm repository index YAML. - properties: - accessFrom: - description: |- - AccessFrom specifies an Access Control List for allowing cross-namespace - references to this object. - NOTE: Not implemented, provisional as of https://github.com/fluxcd/flux2/pull/2092 - properties: - namespaceSelectors: - description: |- - NamespaceSelectors is the list of namespace selectors to which this ACL applies. - Items in this list are evaluated using a logical OR operation. - items: - description: |- - NamespaceSelector selects the namespaces to which this ACL applies. - An empty map of MatchLabels matches all namespaces in a cluster. - properties: - matchLabels: - additionalProperties: - type: string - description: |- - MatchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, whose key field is "key", the - operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - type: object - type: array - required: - - namespaceSelectors - type: object - certSecretRef: - description: |- - CertSecretRef can be given the name of a Secret containing - either or both of - - - a PEM-encoded client certificate (`tls.crt`) and private - key (`tls.key`); - - a PEM-encoded CA certificate (`ca.crt`) - - and whichever are supplied, will be used for connecting to the - registry. The client cert and key are useful if you are - authenticating with a certificate; the CA cert is useful if - you are using a self-signed server certificate. The Secret must - be of type `Opaque` or `kubernetes.io/tls`. - - It takes precedence over the values specified in the Secret referred - to by `.spec.secretRef`. - properties: - name: - description: Name of the referent. - type: string - required: - - name - type: object - insecure: - description: |- - Insecure allows connecting to a non-TLS HTTP container registry. - This field is only taken into account if the .spec.type field is set to 'oci'. - type: boolean - interval: - description: |- - Interval at which the HelmRepository URL is checked for updates. - This interval is approximate and may be subject to jitter to ensure - efficient use of resources. - pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$ - type: string - passCredentials: - description: |- - PassCredentials allows the credentials from the SecretRef to be passed - on to a host that does not match the host as defined in URL. - This may be required if the host of the advertised chart URLs in the - index differ from the defined URL. - Enabling this should be done with caution, as it can potentially result - in credentials getting stolen in a MITM-attack. - type: boolean - provider: - default: generic - description: |- - Provider used for authentication, can be 'aws', 'azure', 'gcp' or 'generic'. - This field is optional, and only taken into account if the .spec.type field is set to 'oci'. - When not specified, defaults to 'generic'. - enum: - - generic - - aws - - azure - - gcp - type: string - secretRef: - description: |- - SecretRef specifies the Secret containing authentication credentials - for the HelmRepository. - For HTTP/S basic auth the secret must contain 'username' and 'password' - fields. - Support for TLS auth using the 'certFile' and 'keyFile', and/or 'caFile' - keys is deprecated. Please use `.spec.certSecretRef` instead. - properties: - name: - description: Name of the referent. - type: string - required: - - name - type: object - suspend: - description: |- - Suspend tells the controller to suspend the reconciliation of this - HelmRepository. - type: boolean - timeout: - description: |- - Timeout is used for the index fetch operation for an HTTPS helm repository, - and for remote OCI Repository operations like pulling for an OCI helm - chart by the associated HelmChart. - Its default value is 60s. - pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m))+$ - type: string - type: - description: |- - Type of the HelmRepository. - When this field is set to "oci", the URL field value must be prefixed with "oci://". - enum: - - default - - oci - type: string - url: - description: |- - URL of the Helm repository, a valid URL contains at least a protocol and - host. - pattern: ^(http|https|oci)://.*$ - type: string - required: - - url - type: object - status: - default: - observedGeneration: -1 - description: HelmRepositoryStatus records the observed state of the HelmRepository. - properties: - artifact: - description: Artifact represents the last successful HelmRepository reconciliation. - properties: - digest: - description: Digest is the digest of the file in the form of ':'. - pattern: ^[a-z0-9]+(?:[.+_-][a-z0-9]+)*:[a-zA-Z0-9=_-]+$ - type: string - lastUpdateTime: - description: |- - LastUpdateTime is the timestamp corresponding to the last update of the - Artifact. - format: date-time - type: string - metadata: - additionalProperties: - type: string - description: Metadata holds upstream information such as OCI annotations. - type: object - path: - description: |- - Path is the relative file path of the Artifact. It can be used to locate - the file in the root of the Artifact storage on the local file system of - the controller managing the Source. - type: string - revision: - description: |- - Revision is a human-readable identifier traceable in the origin source - system. It can be a Git commit SHA, Git tag, a Helm chart version, etc. - type: string - size: - description: Size is the number of bytes in the file. - format: int64 - type: integer - url: - description: |- - URL is the HTTP address of the Artifact as exposed by the controller - managing the Source. It can be used to retrieve the Artifact for - consumption, e.g. by another controller applying the Artifact contents. - type: string - required: - - digest - - lastUpdateTime - - path - - revision - - url - type: object - conditions: - description: Conditions holds the conditions for the HelmRepository. - items: - description: Condition contains details for one aspect of the current state of this API Resource. - properties: - lastTransitionTime: - description: |- - lastTransitionTime is the last time the condition transitioned from one status to another. - This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. - format: date-time - type: string - message: - description: |- - message is a human readable message indicating details about the transition. - This may be an empty string. - maxLength: 32768 - type: string - observedGeneration: - description: |- - observedGeneration represents the .metadata.generation that the condition was set based upon. - For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date - with respect to the current state of the instance. - format: int64 - minimum: 0 - type: integer - reason: - description: |- - reason contains a programmatic identifier indicating the reason for the condition's last transition. - Producers of specific condition types may define expected values and meanings for this field, - and whether the values are considered a guaranteed API. - The value should be a CamelCase string. - This field may not be empty. - maxLength: 1024 - minLength: 1 - pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ - type: string - status: - description: status of the condition, one of True, False, Unknown. - enum: - - "True" - - "False" - - Unknown - type: string - type: - description: type of condition in CamelCase or in foo.example.com/CamelCase. - maxLength: 316 - pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ - type: string - required: - - lastTransitionTime - - message - - reason - - status - - type - type: object - type: array - lastHandledReconcileAt: - description: |- - LastHandledReconcileAt holds the value of the most recent - reconcile request value, so a change of the annotation value - can be detected. - type: string - observedGeneration: - description: |- - ObservedGeneration is the last observed generation of the HelmRepository - object. - format: int64 - type: integer - url: - description: |- - URL is the dynamic fetch link for the latest Artifact. - It is provided on a "best effort" basis, and using the precise - HelmRepositoryStatus.Artifact data is recommended. - type: string - type: object - type: object - served: true - storage: false - subresources: - status: {} --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition @@ -6457,7 +3821,7 @@ metadata: labels: app.kubernetes.io/name: flux app.kubernetes.io/part-of: flux - app.kubernetes.io/version: v2.7.3 + app.kubernetes.io/version: v2.8.0 name: imagepolicies.image.toolkit.fluxcd.io spec: group: image.toolkit.fluxcd.io @@ -7033,7 +4397,7 @@ metadata: labels: app.kubernetes.io/name: flux app.kubernetes.io/part-of: flux - app.kubernetes.io/version: v2.7.3 + app.kubernetes.io/version: v2.8.0 name: imagerepositories.image.toolkit.fluxcd.io spec: group: image.toolkit.fluxcd.io @@ -7639,7 +5003,7 @@ metadata: labels: app.kubernetes.io/name: flux app.kubernetes.io/part-of: flux - app.kubernetes.io/version: v2.7.3 + app.kubernetes.io/version: v2.8.0 name: imageupdateautomations.image.toolkit.fluxcd.io spec: group: image.toolkit.fluxcd.io @@ -8448,7 +5812,7 @@ metadata: labels: app.kubernetes.io/name: flux app.kubernetes.io/part-of: flux - app.kubernetes.io/version: v2.7.3 + app.kubernetes.io/version: v2.8.0 name: kustomizations.kustomize.toolkit.fluxcd.io spec: group: kustomize.toolkit.fluxcd.io @@ -9129,637 +6493,6 @@ spec: storage: true subresources: status: {} - - additionalPrinterColumns: - - jsonPath: .metadata.creationTimestamp - name: Age - type: date - - jsonPath: .status.conditions[?(@.type=="Ready")].status - name: Ready - type: string - - jsonPath: .status.conditions[?(@.type=="Ready")].message - name: Status - type: string - deprecated: true - deprecationWarning: v1beta2 Kustomization is deprecated, upgrade to v1 - name: v1beta2 - schema: - openAPIV3Schema: - description: Kustomization is the Schema for the kustomizations API. - properties: - apiVersion: - description: |- - APIVersion defines the versioned schema of this representation of an object. - Servers should convert recognized schemas to the latest internal value, and - may reject unrecognized values. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources - type: string - kind: - description: |- - Kind is a string value representing the REST resource this object represents. - Servers may infer this from the endpoint the client submits requests to. - Cannot be updated. - In CamelCase. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds - type: string - metadata: - type: object - spec: - description: KustomizationSpec defines the configuration to calculate the desired state from a Source using Kustomize. - properties: - commonMetadata: - description: |- - CommonMetadata specifies the common labels and annotations that are applied to all resources. - Any existing label or annotation will be overridden if its key matches a common one. - properties: - annotations: - additionalProperties: - type: string - description: Annotations to be added to the object's metadata. - type: object - labels: - additionalProperties: - type: string - description: Labels to be added to the object's metadata. - type: object - type: object - components: - description: Components specifies relative paths to specifications of other Components. - items: - type: string - type: array - decryption: - description: Decrypt Kubernetes secrets before applying them on the cluster. - properties: - provider: - description: Provider is the name of the decryption engine. - enum: - - sops - type: string - secretRef: - description: The secret name containing the private OpenPGP keys used for decryption. - properties: - name: - description: Name of the referent. - type: string - required: - - name - type: object - required: - - provider - type: object - dependsOn: - description: |- - DependsOn may contain a meta.NamespacedObjectReference slice - with references to Kustomization resources that must be ready before this - Kustomization can be reconciled. - items: - description: |- - NamespacedObjectReference contains enough information to locate the referenced Kubernetes resource object in any - namespace. - properties: - name: - description: Name of the referent. - type: string - namespace: - description: Namespace of the referent, when not specified it acts as LocalObjectReference. - type: string - required: - - name - type: object - type: array - force: - default: false - description: |- - Force instructs the controller to recreate resources - when patching fails due to an immutable field change. - type: boolean - healthChecks: - description: A list of resources to be included in the health assessment. - items: - description: |- - NamespacedObjectKindReference contains enough information to locate the typed referenced Kubernetes resource object - in any namespace. - properties: - apiVersion: - description: API version of the referent, if not specified the Kubernetes preferred version will be used. - type: string - kind: - description: Kind of the referent. - type: string - name: - description: Name of the referent. - type: string - namespace: - description: Namespace of the referent, when not specified it acts as LocalObjectReference. - type: string - required: - - kind - - name - type: object - type: array - images: - description: |- - Images is a list of (image name, new name, new tag or digest) - for changing image names, tags or digests. This can also be achieved with a - patch, but this operator is simpler to specify. - items: - description: Image contains an image name, a new name, a new tag or digest, which will replace the original name and tag. - properties: - digest: - description: |- - Digest is the value used to replace the original image tag. - If digest is present NewTag value is ignored. - type: string - name: - description: Name is a tag-less image name. - type: string - newName: - description: NewName is the value used to replace the original name. - type: string - newTag: - description: NewTag is the value used to replace the original tag. - type: string - required: - - name - type: object - type: array - interval: - description: The interval at which to reconcile the Kustomization. - pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$ - type: string - kubeConfig: - description: |- - The KubeConfig for reconciling the Kustomization on a remote cluster. - When used in combination with KustomizationSpec.ServiceAccountName, - forces the controller to act on behalf of that Service Account at the - target cluster. - If the --default-service-account flag is set, its value will be used as - a controller level fallback for when KustomizationSpec.ServiceAccountName - is empty. - properties: - configMapRef: - description: |- - ConfigMapRef holds an optional name of a ConfigMap that contains - the following keys: - - - `provider`: the provider to use. One of `aws`, `azure`, `gcp`, or - `generic`. Required. - - `cluster`: the fully qualified resource name of the Kubernetes - cluster in the cloud provider API. Not used by the `generic` - provider. Required when one of `address` or `ca.crt` is not set. - - `address`: the address of the Kubernetes API server. Required - for `generic`. For the other providers, if not specified, the - first address in the cluster resource will be used, and if - specified, it must match one of the addresses in the cluster - resource. - If audiences is not set, will be used as the audience for the - `generic` provider. - - `ca.crt`: the optional PEM-encoded CA certificate for the - Kubernetes API server. If not set, the controller will use the - CA certificate from the cluster resource. - - `audiences`: the optional audiences as a list of - line-break-separated strings for the Kubernetes ServiceAccount - token. Defaults to the `address` for the `generic` provider, or - to specific values for the other providers depending on the - provider. - - `serviceAccountName`: the optional name of the Kubernetes - ServiceAccount in the same namespace that should be used - for authentication. If not specified, the controller - ServiceAccount will be used. - - Mutually exclusive with SecretRef. - properties: - name: - description: Name of the referent. - type: string - required: - - name - type: object - secretRef: - description: |- - SecretRef holds an optional name of a secret that contains a key with - the kubeconfig file as the value. If no key is set, the key will default - to 'value'. Mutually exclusive with ConfigMapRef. - It is recommended that the kubeconfig is self-contained, and the secret - is regularly updated if credentials such as a cloud-access-token expire. - Cloud specific `cmd-path` auth helpers will not function without adding - binaries and credentials to the Pod that is responsible for reconciling - Kubernetes resources. Supported only for the generic provider. - properties: - key: - description: Key in the Secret, when not specified an implementation-specific default key is used. - type: string - name: - description: Name of the Secret. - type: string - required: - - name - type: object - type: object - x-kubernetes-validations: - - message: exactly one of spec.kubeConfig.configMapRef or spec.kubeConfig.secretRef must be specified - rule: has(self.configMapRef) || has(self.secretRef) - - message: exactly one of spec.kubeConfig.configMapRef or spec.kubeConfig.secretRef must be specified - rule: '!has(self.configMapRef) || !has(self.secretRef)' - patches: - description: |- - Strategic merge and JSON patches, defined as inline YAML objects, - capable of targeting objects based on kind, label and annotation selectors. - items: - description: |- - Patch contains an inline StrategicMerge or JSON6902 patch, and the target the patch should - be applied to. - properties: - patch: - description: |- - Patch contains an inline StrategicMerge patch or an inline JSON6902 patch with - an array of operation objects. - type: string - target: - description: Target points to the resources that the patch document should be applied to. - properties: - annotationSelector: - description: |- - AnnotationSelector is a string that follows the label selection expression - https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api - It matches with the resource annotations. - type: string - group: - description: |- - Group is the API group to select resources from. - Together with Version and Kind it is capable of unambiguously identifying and/or selecting resources. - https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md - type: string - kind: - description: |- - Kind of the API Group to select resources from. - Together with Group and Version it is capable of unambiguously - identifying and/or selecting resources. - https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md - type: string - labelSelector: - description: |- - LabelSelector is a string that follows the label selection expression - https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api - It matches with the resource labels. - type: string - name: - description: Name to match resources with. - type: string - namespace: - description: Namespace to select resources from. - type: string - version: - description: |- - Version of the API Group to select resources from. - Together with Group and Kind it is capable of unambiguously identifying and/or selecting resources. - https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md - type: string - type: object - required: - - patch - type: object - type: array - patchesJson6902: - description: |- - JSON 6902 patches, defined as inline YAML objects. - Deprecated: Use Patches instead. - items: - description: JSON6902Patch contains a JSON6902 patch and the target the patch should be applied to. - properties: - patch: - description: Patch contains the JSON6902 patch document with an array of operation objects. - items: - description: |- - JSON6902 is a JSON6902 operation object. - https://datatracker.ietf.org/doc/html/rfc6902#section-4 - properties: - from: - description: |- - From contains a JSON-pointer value that references a location within the target document where the operation is - performed. The meaning of the value depends on the value of Op, and is NOT taken into account by all operations. - type: string - op: - description: |- - Op indicates the operation to perform. Its value MUST be one of "add", "remove", "replace", "move", "copy", or - "test". - https://datatracker.ietf.org/doc/html/rfc6902#section-4 - enum: - - test - - remove - - add - - replace - - move - - copy - type: string - path: - description: |- - Path contains the JSON-pointer value that references a location within the target document where the operation - is performed. The meaning of the value depends on the value of Op. - type: string - value: - description: |- - Value contains a valid JSON structure. The meaning of the value depends on the value of Op, and is NOT taken into - account by all operations. - x-kubernetes-preserve-unknown-fields: true - required: - - op - - path - type: object - type: array - target: - description: Target points to the resources that the patch document should be applied to. - properties: - annotationSelector: - description: |- - AnnotationSelector is a string that follows the label selection expression - https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api - It matches with the resource annotations. - type: string - group: - description: |- - Group is the API group to select resources from. - Together with Version and Kind it is capable of unambiguously identifying and/or selecting resources. - https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md - type: string - kind: - description: |- - Kind of the API Group to select resources from. - Together with Group and Version it is capable of unambiguously - identifying and/or selecting resources. - https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md - type: string - labelSelector: - description: |- - LabelSelector is a string that follows the label selection expression - https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api - It matches with the resource labels. - type: string - name: - description: Name to match resources with. - type: string - namespace: - description: Namespace to select resources from. - type: string - version: - description: |- - Version of the API Group to select resources from. - Together with Group and Kind it is capable of unambiguously identifying and/or selecting resources. - https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md - type: string - type: object - required: - - patch - - target - type: object - type: array - patchesStrategicMerge: - description: |- - Strategic merge patches, defined as inline YAML objects. - Deprecated: Use Patches instead. - items: - x-kubernetes-preserve-unknown-fields: true - type: array - path: - description: |- - Path to the directory containing the kustomization.yaml file, or the - set of plain YAMLs a kustomization.yaml should be generated for. - Defaults to 'None', which translates to the root path of the SourceRef. - type: string - postBuild: - description: |- - PostBuild describes which actions to perform on the YAML manifest - generated by building the kustomize overlay. - properties: - substitute: - additionalProperties: - type: string - description: |- - Substitute holds a map of key/value pairs. - The variables defined in your YAML manifests - that match any of the keys defined in the map - will be substituted with the set value. - Includes support for bash string replacement functions - e.g. ${var:=default}, ${var:position} and ${var/substring/replacement}. - type: object - substituteFrom: - description: |- - SubstituteFrom holds references to ConfigMaps and Secrets containing - the variables and their values to be substituted in the YAML manifests. - The ConfigMap and the Secret data keys represent the var names and they - must match the vars declared in the manifests for the substitution to happen. - items: - description: |- - SubstituteReference contains a reference to a resource containing - the variables name and value. - properties: - kind: - description: Kind of the values referent, valid values are ('Secret', 'ConfigMap'). - enum: - - Secret - - ConfigMap - type: string - name: - description: |- - Name of the values referent. Should reside in the same namespace as the - referring resource. - maxLength: 253 - minLength: 1 - type: string - optional: - default: false - description: |- - Optional indicates whether the referenced resource must exist, or whether to - tolerate its absence. If true and the referenced resource is absent, proceed - as if the resource was present but empty, without any variables defined. - type: boolean - required: - - kind - - name - type: object - type: array - type: object - prune: - description: Prune enables garbage collection. - type: boolean - retryInterval: - description: |- - The interval at which to retry a previously failed reconciliation. - When not specified, the controller uses the KustomizationSpec.Interval - value to retry failures. - pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$ - type: string - serviceAccountName: - description: |- - The name of the Kubernetes service account to impersonate - when reconciling this Kustomization. - type: string - sourceRef: - description: Reference of the source where the kustomization file is. - properties: - apiVersion: - description: API version of the referent. - type: string - kind: - description: Kind of the referent. - enum: - - OCIRepository - - GitRepository - - Bucket - type: string - name: - description: Name of the referent. - type: string - namespace: - description: Namespace of the referent, defaults to the namespace of the Kubernetes resource object that contains the reference. - type: string - required: - - kind - - name - type: object - suspend: - description: |- - This flag tells the controller to suspend subsequent kustomize executions, - it does not apply to already started executions. Defaults to false. - type: boolean - targetNamespace: - description: |- - TargetNamespace sets or overrides the namespace in the - kustomization.yaml file. - maxLength: 63 - minLength: 1 - type: string - timeout: - description: |- - Timeout for validation, apply and health checking operations. - Defaults to 'Interval' duration. - pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$ - type: string - validation: - description: 'Deprecated: Not used in v1beta2.' - enum: - - none - - client - - server - type: string - wait: - description: |- - Wait instructs the controller to check the health of all the reconciled resources. - When enabled, the HealthChecks are ignored. Defaults to false. - type: boolean - required: - - interval - - prune - - sourceRef - type: object - status: - default: - observedGeneration: -1 - description: KustomizationStatus defines the observed state of a kustomization. - properties: - conditions: - items: - description: Condition contains details for one aspect of the current state of this API Resource. - properties: - lastTransitionTime: - description: |- - lastTransitionTime is the last time the condition transitioned from one status to another. - This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. - format: date-time - type: string - message: - description: |- - message is a human readable message indicating details about the transition. - This may be an empty string. - maxLength: 32768 - type: string - observedGeneration: - description: |- - observedGeneration represents the .metadata.generation that the condition was set based upon. - For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date - with respect to the current state of the instance. - format: int64 - minimum: 0 - type: integer - reason: - description: |- - reason contains a programmatic identifier indicating the reason for the condition's last transition. - Producers of specific condition types may define expected values and meanings for this field, - and whether the values are considered a guaranteed API. - The value should be a CamelCase string. - This field may not be empty. - maxLength: 1024 - minLength: 1 - pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ - type: string - status: - description: status of the condition, one of True, False, Unknown. - enum: - - "True" - - "False" - - Unknown - type: string - type: - description: type of condition in CamelCase or in foo.example.com/CamelCase. - maxLength: 316 - pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ - type: string - required: - - lastTransitionTime - - message - - reason - - status - - type - type: object - type: array - inventory: - description: Inventory contains the list of Kubernetes resource object references that have been successfully applied. - properties: - entries: - description: Entries of Kubernetes resource object references. - items: - description: ResourceRef contains the information necessary to locate a resource within a cluster. - properties: - id: - description: |- - ID is the string representation of the Kubernetes resource object's metadata, - in the format '___'. - type: string - v: - description: Version is the API version of the Kubernetes resource object's kind. - type: string - required: - - id - - v - type: object - type: array - required: - - entries - type: object - lastAppliedRevision: - description: |- - The last successfully applied revision. - Equals the Revision of the applied Artifact from the referenced Source. - type: string - lastAttemptedRevision: - description: LastAttemptedRevision is the revision of the last reconciliation attempt. - type: string - lastHandledReconcileAt: - description: |- - LastHandledReconcileAt holds the value of the most recent - reconcile request value, so a change of the annotation value - can be detected. - type: string - observedGeneration: - description: ObservedGeneration is the last reconciled generation. - format: int64 - type: integer - type: object - type: object - served: true - storage: false - subresources: - status: {} --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition @@ -9770,7 +6503,7 @@ metadata: labels: app.kubernetes.io/name: flux app.kubernetes.io/part-of: flux - app.kubernetes.io/version: v2.7.3 + app.kubernetes.io/version: v2.8.0 name: ocirepositories.source.toolkit.fluxcd.io spec: group: source.toolkit.fluxcd.io @@ -10168,410 +6901,6 @@ spec: storage: true subresources: status: {} - - additionalPrinterColumns: - - jsonPath: .spec.url - name: URL - type: string - - jsonPath: .status.conditions[?(@.type=="Ready")].status - name: Ready - type: string - - jsonPath: .status.conditions[?(@.type=="Ready")].message - name: Status - type: string - - jsonPath: .metadata.creationTimestamp - name: Age - type: date - deprecated: true - deprecationWarning: v1beta2 OCIRepository is deprecated, upgrade to v1 - name: v1beta2 - schema: - openAPIV3Schema: - description: OCIRepository is the Schema for the ocirepositories API - properties: - apiVersion: - description: |- - APIVersion defines the versioned schema of this representation of an object. - Servers should convert recognized schemas to the latest internal value, and - may reject unrecognized values. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources - type: string - kind: - description: |- - Kind is a string value representing the REST resource this object represents. - Servers may infer this from the endpoint the client submits requests to. - Cannot be updated. - In CamelCase. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds - type: string - metadata: - type: object - spec: - description: OCIRepositorySpec defines the desired state of OCIRepository - properties: - certSecretRef: - description: |- - CertSecretRef can be given the name of a Secret containing - either or both of - - - a PEM-encoded client certificate (`tls.crt`) and private - key (`tls.key`); - - a PEM-encoded CA certificate (`ca.crt`) - - and whichever are supplied, will be used for connecting to the - registry. The client cert and key are useful if you are - authenticating with a certificate; the CA cert is useful if - you are using a self-signed server certificate. The Secret must - be of type `Opaque` or `kubernetes.io/tls`. - - Note: Support for the `caFile`, `certFile` and `keyFile` keys have - been deprecated. - properties: - name: - description: Name of the referent. - type: string - required: - - name - type: object - ignore: - description: |- - Ignore overrides the set of excluded patterns in the .sourceignore format - (which is the same as .gitignore). If not provided, a default will be used, - consult the documentation for your version to find out what those are. - type: string - insecure: - description: Insecure allows connecting to a non-TLS HTTP container registry. - type: boolean - interval: - description: |- - Interval at which the OCIRepository URL is checked for updates. - This interval is approximate and may be subject to jitter to ensure - efficient use of resources. - pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$ - type: string - layerSelector: - description: |- - LayerSelector specifies which layer should be extracted from the OCI artifact. - When not specified, the first layer found in the artifact is selected. - properties: - mediaType: - description: |- - MediaType specifies the OCI media type of the layer - which should be extracted from the OCI Artifact. The - first layer matching this type is selected. - type: string - operation: - description: |- - Operation specifies how the selected layer should be processed. - By default, the layer compressed content is extracted to storage. - When the operation is set to 'copy', the layer compressed content - is persisted to storage as it is. - enum: - - extract - - copy - type: string - type: object - provider: - default: generic - description: |- - The provider used for authentication, can be 'aws', 'azure', 'gcp' or 'generic'. - When not specified, defaults to 'generic'. - enum: - - generic - - aws - - azure - - gcp - type: string - proxySecretRef: - description: |- - ProxySecretRef specifies the Secret containing the proxy configuration - to use while communicating with the container registry. - properties: - name: - description: Name of the referent. - type: string - required: - - name - type: object - ref: - description: |- - The OCI reference to pull and monitor for changes, - defaults to the latest tag. - properties: - digest: - description: |- - Digest is the image digest to pull, takes precedence over SemVer. - The value should be in the format 'sha256:'. - type: string - semver: - description: |- - SemVer is the range of tags to pull selecting the latest within - the range, takes precedence over Tag. - type: string - semverFilter: - description: SemverFilter is a regex pattern to filter the tags within the SemVer range. - type: string - tag: - description: Tag is the image tag to pull, defaults to latest. - type: string - type: object - secretRef: - description: |- - SecretRef contains the secret name containing the registry login - credentials to resolve image metadata. - The secret must be of type kubernetes.io/dockerconfigjson. - properties: - name: - description: Name of the referent. - type: string - required: - - name - type: object - serviceAccountName: - description: |- - ServiceAccountName is the name of the Kubernetes ServiceAccount used to authenticate - the image pull if the service account has attached pull secrets. For more information: - https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#add-imagepullsecrets-to-a-service-account - type: string - suspend: - description: This flag tells the controller to suspend the reconciliation of this source. - type: boolean - timeout: - default: 60s - description: The timeout for remote OCI Repository operations like pulling, defaults to 60s. - pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m))+$ - type: string - url: - description: |- - URL is a reference to an OCI artifact repository hosted - on a remote container registry. - pattern: ^oci://.*$ - type: string - verify: - description: |- - Verify contains the secret name containing the trusted public keys - used to verify the signature and specifies which provider to use to check - whether OCI image is authentic. - properties: - matchOIDCIdentity: - description: |- - MatchOIDCIdentity specifies the identity matching criteria to use - while verifying an OCI artifact which was signed using Cosign keyless - signing. The artifact's identity is deemed to be verified if any of the - specified matchers match against the identity. - items: - description: |- - OIDCIdentityMatch specifies options for verifying the certificate identity, - i.e. the issuer and the subject of the certificate. - properties: - issuer: - description: |- - Issuer specifies the regex pattern to match against to verify - the OIDC issuer in the Fulcio certificate. The pattern must be a - valid Go regular expression. - type: string - subject: - description: |- - Subject specifies the regex pattern to match against to verify - the identity subject in the Fulcio certificate. The pattern must - be a valid Go regular expression. - type: string - required: - - issuer - - subject - type: object - type: array - provider: - default: cosign - description: Provider specifies the technology used to sign the OCI Artifact. - enum: - - cosign - - notation - type: string - secretRef: - description: |- - SecretRef specifies the Kubernetes Secret containing the - trusted public keys. - properties: - name: - description: Name of the referent. - type: string - required: - - name - type: object - required: - - provider - type: object - required: - - interval - - url - type: object - status: - default: - observedGeneration: -1 - description: OCIRepositoryStatus defines the observed state of OCIRepository - properties: - artifact: - description: Artifact represents the output of the last successful OCI Repository sync. - properties: - digest: - description: Digest is the digest of the file in the form of ':'. - pattern: ^[a-z0-9]+(?:[.+_-][a-z0-9]+)*:[a-zA-Z0-9=_-]+$ - type: string - lastUpdateTime: - description: |- - LastUpdateTime is the timestamp corresponding to the last update of the - Artifact. - format: date-time - type: string - metadata: - additionalProperties: - type: string - description: Metadata holds upstream information such as OCI annotations. - type: object - path: - description: |- - Path is the relative file path of the Artifact. It can be used to locate - the file in the root of the Artifact storage on the local file system of - the controller managing the Source. - type: string - revision: - description: |- - Revision is a human-readable identifier traceable in the origin source - system. It can be a Git commit SHA, Git tag, a Helm chart version, etc. - type: string - size: - description: Size is the number of bytes in the file. - format: int64 - type: integer - url: - description: |- - URL is the HTTP address of the Artifact as exposed by the controller - managing the Source. It can be used to retrieve the Artifact for - consumption, e.g. by another controller applying the Artifact contents. - type: string - required: - - digest - - lastUpdateTime - - path - - revision - - url - type: object - conditions: - description: Conditions holds the conditions for the OCIRepository. - items: - description: Condition contains details for one aspect of the current state of this API Resource. - properties: - lastTransitionTime: - description: |- - lastTransitionTime is the last time the condition transitioned from one status to another. - This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. - format: date-time - type: string - message: - description: |- - message is a human readable message indicating details about the transition. - This may be an empty string. - maxLength: 32768 - type: string - observedGeneration: - description: |- - observedGeneration represents the .metadata.generation that the condition was set based upon. - For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date - with respect to the current state of the instance. - format: int64 - minimum: 0 - type: integer - reason: - description: |- - reason contains a programmatic identifier indicating the reason for the condition's last transition. - Producers of specific condition types may define expected values and meanings for this field, - and whether the values are considered a guaranteed API. - The value should be a CamelCase string. - This field may not be empty. - maxLength: 1024 - minLength: 1 - pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ - type: string - status: - description: status of the condition, one of True, False, Unknown. - enum: - - "True" - - "False" - - Unknown - type: string - type: - description: type of condition in CamelCase or in foo.example.com/CamelCase. - maxLength: 316 - pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ - type: string - required: - - lastTransitionTime - - message - - reason - - status - - type - type: object - type: array - contentConfigChecksum: - description: |- - ContentConfigChecksum is a checksum of all the configurations related to - the content of the source artifact: - - .spec.ignore - - .spec.layerSelector - observed in .status.observedGeneration version of the object. This can - be used to determine if the content configuration has changed and the - artifact needs to be rebuilt. - It has the format of `:`, for example: `sha256:`. - - Deprecated: Replaced with explicit fields for observed artifact content - config in the status. - type: string - lastHandledReconcileAt: - description: |- - LastHandledReconcileAt holds the value of the most recent - reconcile request value, so a change of the annotation value - can be detected. - type: string - observedGeneration: - description: ObservedGeneration is the last observed generation. - format: int64 - type: integer - observedIgnore: - description: |- - ObservedIgnore is the observed exclusion patterns used for constructing - the source artifact. - type: string - observedLayerSelector: - description: |- - ObservedLayerSelector is the observed layer selector used for constructing - the source artifact. - properties: - mediaType: - description: |- - MediaType specifies the OCI media type of the layer - which should be extracted from the OCI Artifact. The - first layer matching this type is selected. - type: string - operation: - description: |- - Operation specifies how the selected layer should be processed. - By default, the layer compressed content is extracted to storage. - When the operation is set to 'copy', the layer compressed content - is persisted to storage as it is. - enum: - - extract - - copy - type: string - type: object - url: - description: URL is the download link for the artifact output of the last OCI Repository sync. - type: string - type: object - type: object - served: true - storage: false - subresources: - status: {} --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition @@ -10582,7 +6911,7 @@ metadata: labels: app.kubernetes.io/name: flux app.kubernetes.io/part-of: flux - app.kubernetes.io/version: v2.7.3 + app.kubernetes.io/version: v2.8.0 name: providers.notification.toolkit.fluxcd.io spec: group: notification.toolkit.fluxcd.io @@ -10942,6 +7271,7 @@ spec: - github - gitlab - gitea + - giteapullrequestcomment - bitbucketserver - bitbucket - azuredevops @@ -10957,6 +7287,8 @@ spec: - alertmanager - grafana - githubdispatch + - githubpullrequestcomment + - gitlabmergerequestcomment - pagerduty - datadog - nats @@ -10987,7 +7319,7 @@ metadata: labels: app.kubernetes.io/name: flux app.kubernetes.io/part-of: flux - app.kubernetes.io/version: v2.7.3 + app.kubernetes.io/version: v2.8.0 name: receivers.notification.toolkit.fluxcd.io spec: group: notification.toolkit.fluxcd.io @@ -11078,6 +7410,8 @@ spec: - ImagePolicy - ImageUpdateAutomation - OCIRepository + - ArtifactGenerator + - ExternalArtifact type: string matchLabels: additionalProperties: @@ -11297,6 +7631,8 @@ spec: - ImagePolicy - ImageUpdateAutomation - OCIRepository + - ArtifactGenerator + - ExternalArtifact type: string matchLabels: additionalProperties: @@ -11459,44 +7795,10 @@ metadata: labels: app.kubernetes.io/name: flux app.kubernetes.io/part-of: flux - app.kubernetes.io/version: v2.7.3 + app.kubernetes.io/version: v2.8.0 pod-security.kubernetes.io/enforce: privileged name: cozy-fluxcd --- -apiVersion: v1 -kind: ResourceQuota -metadata: - annotations: - app.kubernetes.io/role: cluster-admin - labels: - app.kubernetes.io/name: flux - app.kubernetes.io/part-of: flux - app.kubernetes.io/version: v2.7.3 - name: flux - namespace: cozy-fluxcd -spec: - hard: - pods: "1000" - scopeSelector: - matchExpressions: - - operator: In - scopeName: PriorityClass - values: - - system-node-critical - - system-cluster-critical ---- -apiVersion: v1 -kind: ServiceAccount -metadata: - annotations: - app.kubernetes.io/role: cluster-admin - labels: - app.kubernetes.io/name: flux - app.kubernetes.io/part-of: flux - app.kubernetes.io/version: v2.7.3 - name: flux - namespace: cozy-fluxcd ---- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: @@ -11505,7 +7807,7 @@ metadata: labels: app.kubernetes.io/name: flux app.kubernetes.io/part-of: flux - app.kubernetes.io/version: v2.7.3 + app.kubernetes.io/version: v2.8.0 rbac.authorization.k8s.io/aggregate-to-admin: "true" rbac.authorization.k8s.io/aggregate-to-edit: "true" rbac.authorization.k8s.io/aggregate-to-view: "true" @@ -11533,7 +7835,7 @@ metadata: labels: app.kubernetes.io/name: flux app.kubernetes.io/part-of: flux - app.kubernetes.io/version: v2.7.3 + app.kubernetes.io/version: v2.8.0 name: flux roleRef: apiGroup: rbac.authorization.k8s.io @@ -11544,6 +7846,40 @@ subjects: name: flux namespace: cozy-fluxcd --- +apiVersion: v1 +kind: ResourceQuota +metadata: + annotations: + app.kubernetes.io/role: cluster-admin + labels: + app.kubernetes.io/name: flux + app.kubernetes.io/part-of: flux + app.kubernetes.io/version: v2.8.0 + name: flux + namespace: cozy-fluxcd +spec: + hard: + pods: "1000" + scopeSelector: + matchExpressions: + - operator: In + scopeName: PriorityClass + values: + - system-node-critical + - system-cluster-critical +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + annotations: + app.kubernetes.io/role: cluster-admin + labels: + app.kubernetes.io/name: flux + app.kubernetes.io/part-of: flux + app.kubernetes.io/version: v2.8.0 + name: flux + namespace: cozy-fluxcd +--- apiVersion: apps/v1 kind: Deployment metadata: @@ -11552,7 +7888,7 @@ metadata: labels: app.kubernetes.io/name: flux app.kubernetes.io/part-of: flux - app.kubernetes.io/version: v2.7.3 + app.kubernetes.io/version: v2.8.0 name: flux namespace: cozy-fluxcd spec: @@ -11623,7 +7959,7 @@ spec: value: /tmp/.sigstore - name: NO_PROXY value: .svc - image: ghcr.io/fluxcd/source-controller:v1.7.3 + image: ghcr.io/fluxcd/source-controller:v1.8.0 imagePullPolicy: IfNotPresent livenessProbe: httpGet: @@ -11693,7 +8029,7 @@ spec: value: /tmp/.sigstore - name: NO_PROXY value: .svc - image: ghcr.io/fluxcd/kustomize-controller:v1.7.2 + image: ghcr.io/fluxcd/kustomize-controller:v1.8.0 imagePullPolicy: IfNotPresent livenessProbe: httpGet: @@ -11758,7 +8094,7 @@ spec: value: /tmp/.sigstore - name: NO_PROXY value: .svc - image: ghcr.io/fluxcd/helm-controller:v1.4.3 + image: ghcr.io/fluxcd/helm-controller:v1.5.0 imagePullPolicy: IfNotPresent livenessProbe: httpGet: @@ -11820,7 +8156,7 @@ spec: value: /tmp/.sigstore - name: NO_PROXY value: .svc - image: ghcr.io/fluxcd/notification-controller:v1.7.4 + image: ghcr.io/fluxcd/notification-controller:v1.8.0 imagePullPolicy: IfNotPresent livenessProbe: httpGet: @@ -11890,7 +8226,7 @@ spec: value: /tmp/.sigstore - name: NO_PROXY value: .svc - image: ghcr.io/fluxcd/source-watcher:v2.0.2 + image: ghcr.io/fluxcd/source-watcher:v2.1.0 imagePullPolicy: IfNotPresent livenessProbe: httpGet: From 4cc60e3ab5b2381070ecf6627146ecd51af47dce Mon Sep 17 00:00:00 2001 From: Myasnikov Daniil Date: Mon, 25 May 2026 10:09:22 +0500 Subject: [PATCH 03/28] fix(kubevirt-instancetypes): drop persistent strip that produced null TPM `make update` stripped `persistent: true` from upstream's `preferredTPM: { persistent: true }`, leaving the parent key with a null value. KubeVirt v1.6's CRD tolerated it; v1.8 (the operator version we bumped to in 6af0bf71) enforces structural schema and rejects null: VirtualMachineClusterPreference "windows.11" is invalid: spec.devices.preferredTPM: Invalid value: "null": spec.devices.preferredTPM in body must be of type object: "null" Stop stripping the line and regenerate the templates from upstream common-instancetypes. Persistent TPM state falls back to the cluster default StorageClass with RWO access mode when `vmStateStorageClass` is unset on the KubeVirt CR, per pkg/storage/backend-storage/backend-storage.go. Drive-by from the regen: - Removed (upstream EOL): centos.7*, centos.stream8* - Added: debian, oraclelinux, legacy, linux*, fedora.s390x, rhel.{9,10}.s390x, windows.{xp,7,7.virtio,2k3,2k8,2k8.virtio,2k12,2k12.virtio}, plus new cx1.*1gi and d1 instancetype variants. Also regenerates packages/apps/vm-instance instanceProfile enum (values.schema.json / README.md) from the refreshed preferences.yaml. Co-Authored-By: Claude Opus 4.7 (1M context) Signed-off-by: Myasnikov Daniil --- packages/apps/vm-instance/values.schema.json | 22 +- .../system/kubevirt-instancetypes/Makefile | 1 - .../templates/instancetypes.yaml | 900 ++++++++-- .../templates/preferences.yaml | 1453 +++++++++++++---- .../vm-instance-rd/cozyrds/vm-instance.yaml | 2 +- 5 files changed, 1973 insertions(+), 405 deletions(-) diff --git a/packages/apps/vm-instance/values.schema.json b/packages/apps/vm-instance/values.schema.json index 01bd30a95..130eba7cd 100644 --- a/packages/apps/vm-instance/values.schema.json +++ b/packages/apps/vm-instance/values.schema.json @@ -54,23 +54,26 @@ "default": "ubuntu", "enum": [ "alpine", - "centos.7", - "centos.7.desktop", "centos.stream10", "centos.stream10.desktop", - "centos.stream8", - "centos.stream8.desktop", - "centos.stream8.dpdk", "centos.stream9", "centos.stream9.desktop", "centos.stream9.dpdk", "cirros", + "debian", "fedora", "fedora.arm64", + "fedora.s390x", + "legacy", + "linux", + "linux.efi", + "linux.virtiotransitional", "opensuse.leap", "opensuse.tumbleweed", + "oraclelinux", "rhel.10", "rhel.10.arm64", + "rhel.10.s390x", "rhel.7", "rhel.7.desktop", "rhel.8", @@ -81,12 +84,15 @@ "rhel.9.desktop", "rhel.9.dpdk", "rhel.9.realtime", + "rhel.9.s390x", "sles", "ubuntu", "windows.10", "windows.10.virtio", "windows.11", "windows.11.virtio", + "windows.2k12", + "windows.2k12.virtio", "windows.2k16", "windows.2k16.virtio", "windows.2k19", @@ -95,6 +101,12 @@ "windows.2k22.virtio", "windows.2k25", "windows.2k25.virtio", + "windows.2k3", + "windows.2k8", + "windows.2k8.virtio", + "windows.7", + "windows.7.virtio", + "windows.xp", "" ] }, diff --git a/packages/system/kubevirt-instancetypes/Makefile b/packages/system/kubevirt-instancetypes/Makefile index b9f84b833..f5970d9b9 100644 --- a/packages/system/kubevirt-instancetypes/Makefile +++ b/packages/system/kubevirt-instancetypes/Makefile @@ -10,4 +10,3 @@ update: yq -i 'select(.kind != "VirtualMachinePreference")' templates/preferences.yaml kustomize build https://github.com/kubevirt/common-instancetypes/instancetypes > templates/instancetypes.yaml yq -i 'select(.kind != "VirtualMachineInstancetype")' templates/instancetypes.yaml - sed -i '/persistent: true/d' templates/preferences.yaml diff --git a/packages/system/kubevirt-instancetypes/templates/instancetypes.yaml b/packages/system/kubevirt-instancetypes/templates/instancetypes.yaml index a4dfe2e9b..76cd28fc6 100644 --- a/packages/system/kubevirt-instancetypes/templates/instancetypes.yaml +++ b/packages/system/kubevirt-instancetypes/templates/instancetypes.yaml @@ -14,12 +14,21 @@ metadata: the IO threading from cores dedicated to the workload. In addition, in this series, the NUMA topology of the used cores is provided to the VM. + + The amount of spec.cpu.maxSockets is set to the same as + guest cpus. This avoids KubeVirt's default behavior of + providing extra CPUs for hotplugging, which can exceed the + amount of available CPUs on a node and cause the VM to fail. + + Requirements for CX series instance types: + - CPU manager has to be enabled. + - Huge pages have to be available on the nodes. instancetype.kubevirt.io/displayName: Compute Exclusive labels: instancetype.kubevirt.io/class: compute.exclusive instancetype.kubevirt.io/cpu: "8" instancetype.kubevirt.io/dedicatedCPUPlacement: "true" - instancetype.kubevirt.io/hugepages: "true" + instancetype.kubevirt.io/hugepages: 2Mi instancetype.kubevirt.io/icon-pf: pficon-registry instancetype.kubevirt.io/isolateEmulatorThread: "true" instancetype.kubevirt.io/memory: 16Gi @@ -33,6 +42,7 @@ spec: dedicatedCPUPlacement: true guest: 8 isolateEmulatorThread: true + maxSockets: 8 numa: guestMappingPassthrough: {} ioThreadsPolicy: auto @@ -57,12 +67,74 @@ metadata: the IO threading from cores dedicated to the workload. In addition, in this series, the NUMA topology of the used cores is provided to the VM. + + The amount of spec.cpu.maxSockets is set to the same as + guest cpus. This avoids KubeVirt's default behavior of + providing extra CPUs for hotplugging, which can exceed the + amount of available CPUs on a node and cause the VM to fail. + + Requirements for CX series instance types: + - CPU manager has to be enabled. + - Huge pages have to be available on the nodes. + instancetype.kubevirt.io/displayName: Compute Exclusive + labels: + instancetype.kubevirt.io/class: compute.exclusive + instancetype.kubevirt.io/cpu: "8" + instancetype.kubevirt.io/dedicatedCPUPlacement: "true" + instancetype.kubevirt.io/hugepages: 1Gi + instancetype.kubevirt.io/icon-pf: pficon-registry + instancetype.kubevirt.io/isolateEmulatorThread: "true" + instancetype.kubevirt.io/memory: 16Gi + instancetype.kubevirt.io/numa: "true" + instancetype.kubevirt.io/size: 2xlarge1gi + instancetype.kubevirt.io/vendor: kubevirt.io + instancetype.kubevirt.io/version: "1" + name: cx1.2xlarge1gi +spec: + cpu: + dedicatedCPUPlacement: true + guest: 8 + isolateEmulatorThread: true + maxSockets: 8 + numa: + guestMappingPassthrough: {} + ioThreadsPolicy: auto + memory: + guest: 16Gi + hugepages: + pageSize: 1Gi +--- +apiVersion: instancetype.kubevirt.io/v1beta1 +kind: VirtualMachineClusterInstancetype +metadata: + annotations: + instancetype.kubevirt.io/description: |- + The CX Series provides exclusive compute resources for compute + intensive applications. + + *CX* is the abbreviation of "Compute Exclusive". + + The exclusive resources are given to the compute threads of the + VM. In order to ensure this, some additional cores (depending + on the number of disks and NICs) will be requested to offload + the IO threading from cores dedicated to the workload. + In addition, in this series, the NUMA topology of the used + cores is provided to the VM. + + The amount of spec.cpu.maxSockets is set to the same as + guest cpus. This avoids KubeVirt's default behavior of + providing extra CPUs for hotplugging, which can exceed the + amount of available CPUs on a node and cause the VM to fail. + + Requirements for CX series instance types: + - CPU manager has to be enabled. + - Huge pages have to be available on the nodes. instancetype.kubevirt.io/displayName: Compute Exclusive labels: instancetype.kubevirt.io/class: compute.exclusive instancetype.kubevirt.io/cpu: "16" instancetype.kubevirt.io/dedicatedCPUPlacement: "true" - instancetype.kubevirt.io/hugepages: "true" + instancetype.kubevirt.io/hugepages: 2Mi instancetype.kubevirt.io/icon-pf: pficon-registry instancetype.kubevirt.io/isolateEmulatorThread: "true" instancetype.kubevirt.io/memory: 32Gi @@ -76,6 +148,7 @@ spec: dedicatedCPUPlacement: true guest: 16 isolateEmulatorThread: true + maxSockets: 16 numa: guestMappingPassthrough: {} ioThreadsPolicy: auto @@ -100,12 +173,74 @@ metadata: the IO threading from cores dedicated to the workload. In addition, in this series, the NUMA topology of the used cores is provided to the VM. + + The amount of spec.cpu.maxSockets is set to the same as + guest cpus. This avoids KubeVirt's default behavior of + providing extra CPUs for hotplugging, which can exceed the + amount of available CPUs on a node and cause the VM to fail. + + Requirements for CX series instance types: + - CPU manager has to be enabled. + - Huge pages have to be available on the nodes. + instancetype.kubevirt.io/displayName: Compute Exclusive + labels: + instancetype.kubevirt.io/class: compute.exclusive + instancetype.kubevirt.io/cpu: "16" + instancetype.kubevirt.io/dedicatedCPUPlacement: "true" + instancetype.kubevirt.io/hugepages: 1Gi + instancetype.kubevirt.io/icon-pf: pficon-registry + instancetype.kubevirt.io/isolateEmulatorThread: "true" + instancetype.kubevirt.io/memory: 32Gi + instancetype.kubevirt.io/numa: "true" + instancetype.kubevirt.io/size: 4xlarge1gi + instancetype.kubevirt.io/vendor: kubevirt.io + instancetype.kubevirt.io/version: "1" + name: cx1.4xlarge1gi +spec: + cpu: + dedicatedCPUPlacement: true + guest: 16 + isolateEmulatorThread: true + maxSockets: 16 + numa: + guestMappingPassthrough: {} + ioThreadsPolicy: auto + memory: + guest: 32Gi + hugepages: + pageSize: 1Gi +--- +apiVersion: instancetype.kubevirt.io/v1beta1 +kind: VirtualMachineClusterInstancetype +metadata: + annotations: + instancetype.kubevirt.io/description: |- + The CX Series provides exclusive compute resources for compute + intensive applications. + + *CX* is the abbreviation of "Compute Exclusive". + + The exclusive resources are given to the compute threads of the + VM. In order to ensure this, some additional cores (depending + on the number of disks and NICs) will be requested to offload + the IO threading from cores dedicated to the workload. + In addition, in this series, the NUMA topology of the used + cores is provided to the VM. + + The amount of spec.cpu.maxSockets is set to the same as + guest cpus. This avoids KubeVirt's default behavior of + providing extra CPUs for hotplugging, which can exceed the + amount of available CPUs on a node and cause the VM to fail. + + Requirements for CX series instance types: + - CPU manager has to be enabled. + - Huge pages have to be available on the nodes. instancetype.kubevirt.io/displayName: Compute Exclusive labels: instancetype.kubevirt.io/class: compute.exclusive instancetype.kubevirt.io/cpu: "32" instancetype.kubevirt.io/dedicatedCPUPlacement: "true" - instancetype.kubevirt.io/hugepages: "true" + instancetype.kubevirt.io/hugepages: 2Mi instancetype.kubevirt.io/icon-pf: pficon-registry instancetype.kubevirt.io/isolateEmulatorThread: "true" instancetype.kubevirt.io/memory: 64Gi @@ -119,6 +254,7 @@ spec: dedicatedCPUPlacement: true guest: 32 isolateEmulatorThread: true + maxSockets: 32 numa: guestMappingPassthrough: {} ioThreadsPolicy: auto @@ -143,12 +279,74 @@ metadata: the IO threading from cores dedicated to the workload. In addition, in this series, the NUMA topology of the used cores is provided to the VM. + + The amount of spec.cpu.maxSockets is set to the same as + guest cpus. This avoids KubeVirt's default behavior of + providing extra CPUs for hotplugging, which can exceed the + amount of available CPUs on a node and cause the VM to fail. + + Requirements for CX series instance types: + - CPU manager has to be enabled. + - Huge pages have to be available on the nodes. + instancetype.kubevirt.io/displayName: Compute Exclusive + labels: + instancetype.kubevirt.io/class: compute.exclusive + instancetype.kubevirt.io/cpu: "32" + instancetype.kubevirt.io/dedicatedCPUPlacement: "true" + instancetype.kubevirt.io/hugepages: 1Gi + instancetype.kubevirt.io/icon-pf: pficon-registry + instancetype.kubevirt.io/isolateEmulatorThread: "true" + instancetype.kubevirt.io/memory: 64Gi + instancetype.kubevirt.io/numa: "true" + instancetype.kubevirt.io/size: 8xlarge1gi + instancetype.kubevirt.io/vendor: kubevirt.io + instancetype.kubevirt.io/version: "1" + name: cx1.8xlarge1gi +spec: + cpu: + dedicatedCPUPlacement: true + guest: 32 + isolateEmulatorThread: true + maxSockets: 32 + numa: + guestMappingPassthrough: {} + ioThreadsPolicy: auto + memory: + guest: 64Gi + hugepages: + pageSize: 1Gi +--- +apiVersion: instancetype.kubevirt.io/v1beta1 +kind: VirtualMachineClusterInstancetype +metadata: + annotations: + instancetype.kubevirt.io/description: |- + The CX Series provides exclusive compute resources for compute + intensive applications. + + *CX* is the abbreviation of "Compute Exclusive". + + The exclusive resources are given to the compute threads of the + VM. In order to ensure this, some additional cores (depending + on the number of disks and NICs) will be requested to offload + the IO threading from cores dedicated to the workload. + In addition, in this series, the NUMA topology of the used + cores is provided to the VM. + + The amount of spec.cpu.maxSockets is set to the same as + guest cpus. This avoids KubeVirt's default behavior of + providing extra CPUs for hotplugging, which can exceed the + amount of available CPUs on a node and cause the VM to fail. + + Requirements for CX series instance types: + - CPU manager has to be enabled. + - Huge pages have to be available on the nodes. instancetype.kubevirt.io/displayName: Compute Exclusive labels: instancetype.kubevirt.io/class: compute.exclusive instancetype.kubevirt.io/cpu: "2" instancetype.kubevirt.io/dedicatedCPUPlacement: "true" - instancetype.kubevirt.io/hugepages: "true" + instancetype.kubevirt.io/hugepages: 2Mi instancetype.kubevirt.io/icon-pf: pficon-registry instancetype.kubevirt.io/isolateEmulatorThread: "true" instancetype.kubevirt.io/memory: 4Gi @@ -162,6 +360,7 @@ spec: dedicatedCPUPlacement: true guest: 2 isolateEmulatorThread: true + maxSockets: 2 numa: guestMappingPassthrough: {} ioThreadsPolicy: auto @@ -186,12 +385,74 @@ metadata: the IO threading from cores dedicated to the workload. In addition, in this series, the NUMA topology of the used cores is provided to the VM. + + The amount of spec.cpu.maxSockets is set to the same as + guest cpus. This avoids KubeVirt's default behavior of + providing extra CPUs for hotplugging, which can exceed the + amount of available CPUs on a node and cause the VM to fail. + + Requirements for CX series instance types: + - CPU manager has to be enabled. + - Huge pages have to be available on the nodes. + instancetype.kubevirt.io/displayName: Compute Exclusive + labels: + instancetype.kubevirt.io/class: compute.exclusive + instancetype.kubevirt.io/cpu: "2" + instancetype.kubevirt.io/dedicatedCPUPlacement: "true" + instancetype.kubevirt.io/hugepages: 1Gi + instancetype.kubevirt.io/icon-pf: pficon-registry + instancetype.kubevirt.io/isolateEmulatorThread: "true" + instancetype.kubevirt.io/memory: 4Gi + instancetype.kubevirt.io/numa: "true" + instancetype.kubevirt.io/size: large1gi + instancetype.kubevirt.io/vendor: kubevirt.io + instancetype.kubevirt.io/version: "1" + name: cx1.large1gi +spec: + cpu: + dedicatedCPUPlacement: true + guest: 2 + isolateEmulatorThread: true + maxSockets: 2 + numa: + guestMappingPassthrough: {} + ioThreadsPolicy: auto + memory: + guest: 4Gi + hugepages: + pageSize: 1Gi +--- +apiVersion: instancetype.kubevirt.io/v1beta1 +kind: VirtualMachineClusterInstancetype +metadata: + annotations: + instancetype.kubevirt.io/description: |- + The CX Series provides exclusive compute resources for compute + intensive applications. + + *CX* is the abbreviation of "Compute Exclusive". + + The exclusive resources are given to the compute threads of the + VM. In order to ensure this, some additional cores (depending + on the number of disks and NICs) will be requested to offload + the IO threading from cores dedicated to the workload. + In addition, in this series, the NUMA topology of the used + cores is provided to the VM. + + The amount of spec.cpu.maxSockets is set to the same as + guest cpus. This avoids KubeVirt's default behavior of + providing extra CPUs for hotplugging, which can exceed the + amount of available CPUs on a node and cause the VM to fail. + + Requirements for CX series instance types: + - CPU manager has to be enabled. + - Huge pages have to be available on the nodes. instancetype.kubevirt.io/displayName: Compute Exclusive labels: instancetype.kubevirt.io/class: compute.exclusive instancetype.kubevirt.io/cpu: "1" instancetype.kubevirt.io/dedicatedCPUPlacement: "true" - instancetype.kubevirt.io/hugepages: "true" + instancetype.kubevirt.io/hugepages: 2Mi instancetype.kubevirt.io/icon-pf: pficon-registry instancetype.kubevirt.io/isolateEmulatorThread: "true" instancetype.kubevirt.io/memory: 2Gi @@ -205,6 +466,7 @@ spec: dedicatedCPUPlacement: true guest: 1 isolateEmulatorThread: true + maxSockets: 1 numa: guestMappingPassthrough: {} ioThreadsPolicy: auto @@ -229,12 +491,74 @@ metadata: the IO threading from cores dedicated to the workload. In addition, in this series, the NUMA topology of the used cores is provided to the VM. + + The amount of spec.cpu.maxSockets is set to the same as + guest cpus. This avoids KubeVirt's default behavior of + providing extra CPUs for hotplugging, which can exceed the + amount of available CPUs on a node and cause the VM to fail. + + Requirements for CX series instance types: + - CPU manager has to be enabled. + - Huge pages have to be available on the nodes. + instancetype.kubevirt.io/displayName: Compute Exclusive + labels: + instancetype.kubevirt.io/class: compute.exclusive + instancetype.kubevirt.io/cpu: "1" + instancetype.kubevirt.io/dedicatedCPUPlacement: "true" + instancetype.kubevirt.io/hugepages: 1Gi + instancetype.kubevirt.io/icon-pf: pficon-registry + instancetype.kubevirt.io/isolateEmulatorThread: "true" + instancetype.kubevirt.io/memory: 2Gi + instancetype.kubevirt.io/numa: "true" + instancetype.kubevirt.io/size: medium1gi + instancetype.kubevirt.io/vendor: kubevirt.io + instancetype.kubevirt.io/version: "1" + name: cx1.medium1gi +spec: + cpu: + dedicatedCPUPlacement: true + guest: 1 + isolateEmulatorThread: true + maxSockets: 1 + numa: + guestMappingPassthrough: {} + ioThreadsPolicy: auto + memory: + guest: 2Gi + hugepages: + pageSize: 1Gi +--- +apiVersion: instancetype.kubevirt.io/v1beta1 +kind: VirtualMachineClusterInstancetype +metadata: + annotations: + instancetype.kubevirt.io/description: |- + The CX Series provides exclusive compute resources for compute + intensive applications. + + *CX* is the abbreviation of "Compute Exclusive". + + The exclusive resources are given to the compute threads of the + VM. In order to ensure this, some additional cores (depending + on the number of disks and NICs) will be requested to offload + the IO threading from cores dedicated to the workload. + In addition, in this series, the NUMA topology of the used + cores is provided to the VM. + + The amount of spec.cpu.maxSockets is set to the same as + guest cpus. This avoids KubeVirt's default behavior of + providing extra CPUs for hotplugging, which can exceed the + amount of available CPUs on a node and cause the VM to fail. + + Requirements for CX series instance types: + - CPU manager has to be enabled. + - Huge pages have to be available on the nodes. instancetype.kubevirt.io/displayName: Compute Exclusive labels: instancetype.kubevirt.io/class: compute.exclusive instancetype.kubevirt.io/cpu: "4" instancetype.kubevirt.io/dedicatedCPUPlacement: "true" - instancetype.kubevirt.io/hugepages: "true" + instancetype.kubevirt.io/hugepages: 2Mi instancetype.kubevirt.io/icon-pf: pficon-registry instancetype.kubevirt.io/isolateEmulatorThread: "true" instancetype.kubevirt.io/memory: 8Gi @@ -248,6 +572,7 @@ spec: dedicatedCPUPlacement: true guest: 4 isolateEmulatorThread: true + maxSockets: 4 numa: guestMappingPassthrough: {} ioThreadsPolicy: auto @@ -261,34 +586,85 @@ kind: VirtualMachineClusterInstancetype metadata: annotations: instancetype.kubevirt.io/description: |- - The GN Series provides instances types intended for VMs with - NVIDIA GPU resources attached. + The CX Series provides exclusive compute resources for compute + intensive applications. - *GN* is the abbreviation of "GPU NVIDIA". + *CX* is the abbreviation of "Compute Exclusive". - This series is intended to be used with VMs consuming GPUs - provided by the - [NVIDIA GPU Operator](https://github.com/NVIDIA/gpu-operator) - which can be installed on Kubernetes and also is made available - on OpenShift via OperatorHub. - instancetype.kubevirt.io/displayName: GPU NVIDIA + The exclusive resources are given to the compute threads of the + VM. In order to ensure this, some additional cores (depending + on the number of disks and NICs) will be requested to offload + the IO threading from cores dedicated to the workload. + In addition, in this series, the NUMA topology of the used + cores is provided to the VM. + + The amount of spec.cpu.maxSockets is set to the same as + guest cpus. This avoids KubeVirt's default behavior of + providing extra CPUs for hotplugging, which can exceed the + amount of available CPUs on a node and cause the VM to fail. + + Requirements for CX series instance types: + - CPU manager has to be enabled. + - Huge pages have to be available on the nodes. + instancetype.kubevirt.io/displayName: Compute Exclusive labels: - instancetype.kubevirt.io/class: gpu.nvidia + instancetype.kubevirt.io/class: compute.exclusive + instancetype.kubevirt.io/cpu: "4" + instancetype.kubevirt.io/dedicatedCPUPlacement: "true" + instancetype.kubevirt.io/hugepages: 1Gi + instancetype.kubevirt.io/icon-pf: pficon-registry + instancetype.kubevirt.io/isolateEmulatorThread: "true" + instancetype.kubevirt.io/memory: 8Gi + instancetype.kubevirt.io/numa: "true" + instancetype.kubevirt.io/size: xlarge1gi + instancetype.kubevirt.io/vendor: kubevirt.io + instancetype.kubevirt.io/version: "1" + name: cx1.xlarge1gi +spec: + cpu: + dedicatedCPUPlacement: true + guest: 4 + isolateEmulatorThread: true + maxSockets: 4 + numa: + guestMappingPassthrough: {} + ioThreadsPolicy: auto + memory: + guest: 8Gi + hugepages: + pageSize: 1Gi +--- +apiVersion: instancetype.kubevirt.io/v1beta1 +kind: VirtualMachineClusterInstancetype +metadata: + annotations: + instancetype.kubevirt.io/description: |- + The D Series is designed for consistent and predictable performance, + providing resources for general purpose applications. + + *D* is the abbreviation for "Dedicated", reflecting the use of + dedicated CPU placement for workloads. + + VMs of this instance type are assigned exclusive physical CPU cores, + avoiding CPU sharing and time-slice contention with other VMs. + instancetype.kubevirt.io/displayName: Dedicated vCPU + labels: + instancetype.kubevirt.io/class: dedicated.vcpu instancetype.kubevirt.io/cpu: "8" - instancetype.kubevirt.io/deprecated: "true" - instancetype.kubevirt.io/gpus: "true" - instancetype.kubevirt.io/icon-pf: fa-microchip + instancetype.kubevirt.io/dedicatedCPUPlacement: "true" + instancetype.kubevirt.io/icon-pf: pficon-server-group + instancetype.kubevirt.io/isolateEmulatorThread: "true" instancetype.kubevirt.io/memory: 32Gi instancetype.kubevirt.io/size: 2xlarge instancetype.kubevirt.io/vendor: kubevirt.io instancetype.kubevirt.io/version: "1" - name: gn1.2xlarge + name: d1.2xlarge spec: cpu: + dedicatedCPUPlacement: true guest: 8 - gpus: - - deviceName: nvidia.com/A400 - name: gpu1 + isolateEmulatorThread: true + ioThreadsPolicy: auto memory: guest: 32Gi --- @@ -297,34 +673,66 @@ kind: VirtualMachineClusterInstancetype metadata: annotations: instancetype.kubevirt.io/description: |- - The GN Series provides instances types intended for VMs with - NVIDIA GPU resources attached. + The D Series is designed for consistent and predictable performance, + providing resources for general purpose applications. - *GN* is the abbreviation of "GPU NVIDIA". + *D* is the abbreviation for "Dedicated", reflecting the use of + dedicated CPU placement for workloads. - This series is intended to be used with VMs consuming GPUs - provided by the - [NVIDIA GPU Operator](https://github.com/NVIDIA/gpu-operator) - which can be installed on Kubernetes and also is made available - on OpenShift via OperatorHub. - instancetype.kubevirt.io/displayName: GPU NVIDIA + VMs of this instance type are assigned exclusive physical CPU cores, + avoiding CPU sharing and time-slice contention with other VMs. + instancetype.kubevirt.io/displayName: Dedicated vCPU labels: - instancetype.kubevirt.io/class: gpu.nvidia + instancetype.kubevirt.io/class: dedicated.vcpu + instancetype.kubevirt.io/cpu: "2" + instancetype.kubevirt.io/dedicatedCPUPlacement: "true" + instancetype.kubevirt.io/icon-pf: pficon-server-group + instancetype.kubevirt.io/isolateEmulatorThread: "true" + instancetype.kubevirt.io/memory: 4Gi + instancetype.kubevirt.io/size: 2xmedium + instancetype.kubevirt.io/vendor: kubevirt.io + instancetype.kubevirt.io/version: "1" + name: d1.2xmedium +spec: + cpu: + dedicatedCPUPlacement: true + guest: 2 + isolateEmulatorThread: true + ioThreadsPolicy: auto + memory: + guest: 4Gi +--- +apiVersion: instancetype.kubevirt.io/v1beta1 +kind: VirtualMachineClusterInstancetype +metadata: + annotations: + instancetype.kubevirt.io/description: |- + The D Series is designed for consistent and predictable performance, + providing resources for general purpose applications. + + *D* is the abbreviation for "Dedicated", reflecting the use of + dedicated CPU placement for workloads. + + VMs of this instance type are assigned exclusive physical CPU cores, + avoiding CPU sharing and time-slice contention with other VMs. + instancetype.kubevirt.io/displayName: Dedicated vCPU + labels: + instancetype.kubevirt.io/class: dedicated.vcpu instancetype.kubevirt.io/cpu: "16" - instancetype.kubevirt.io/deprecated: "true" - instancetype.kubevirt.io/gpus: "true" - instancetype.kubevirt.io/icon-pf: fa-microchip + instancetype.kubevirt.io/dedicatedCPUPlacement: "true" + instancetype.kubevirt.io/icon-pf: pficon-server-group + instancetype.kubevirt.io/isolateEmulatorThread: "true" instancetype.kubevirt.io/memory: 64Gi instancetype.kubevirt.io/size: 4xlarge instancetype.kubevirt.io/vendor: kubevirt.io instancetype.kubevirt.io/version: "1" - name: gn1.4xlarge + name: d1.4xlarge spec: cpu: + dedicatedCPUPlacement: true guest: 16 - gpus: - - deviceName: nvidia.com/A400 - name: gpu1 + isolateEmulatorThread: true + ioThreadsPolicy: auto memory: guest: 64Gi --- @@ -333,34 +741,32 @@ kind: VirtualMachineClusterInstancetype metadata: annotations: instancetype.kubevirt.io/description: |- - The GN Series provides instances types intended for VMs with - NVIDIA GPU resources attached. + The D Series is designed for consistent and predictable performance, + providing resources for general purpose applications. - *GN* is the abbreviation of "GPU NVIDIA". + *D* is the abbreviation for "Dedicated", reflecting the use of + dedicated CPU placement for workloads. - This series is intended to be used with VMs consuming GPUs - provided by the - [NVIDIA GPU Operator](https://github.com/NVIDIA/gpu-operator) - which can be installed on Kubernetes and also is made available - on OpenShift via OperatorHub. - instancetype.kubevirt.io/displayName: GPU NVIDIA + VMs of this instance type are assigned exclusive physical CPU cores, + avoiding CPU sharing and time-slice contention with other VMs. + instancetype.kubevirt.io/displayName: Dedicated vCPU labels: - instancetype.kubevirt.io/class: gpu.nvidia + instancetype.kubevirt.io/class: dedicated.vcpu instancetype.kubevirt.io/cpu: "32" - instancetype.kubevirt.io/deprecated: "true" - instancetype.kubevirt.io/gpus: "true" - instancetype.kubevirt.io/icon-pf: fa-microchip + instancetype.kubevirt.io/dedicatedCPUPlacement: "true" + instancetype.kubevirt.io/icon-pf: pficon-server-group + instancetype.kubevirt.io/isolateEmulatorThread: "true" instancetype.kubevirt.io/memory: 128Gi instancetype.kubevirt.io/size: 8xlarge instancetype.kubevirt.io/vendor: kubevirt.io instancetype.kubevirt.io/version: "1" - name: gn1.8xlarge + name: d1.8xlarge spec: cpu: + dedicatedCPUPlacement: true guest: 32 - gpus: - - deviceName: nvidia.com/A400 - name: gpu1 + isolateEmulatorThread: true + ioThreadsPolicy: auto memory: guest: 128Gi --- @@ -369,34 +775,202 @@ kind: VirtualMachineClusterInstancetype metadata: annotations: instancetype.kubevirt.io/description: |- - The GN Series provides instances types intended for VMs with - NVIDIA GPU resources attached. + The D Series is designed for consistent and predictable performance, + providing resources for general purpose applications. - *GN* is the abbreviation of "GPU NVIDIA". + *D* is the abbreviation for "Dedicated", reflecting the use of + dedicated CPU placement for workloads. - This series is intended to be used with VMs consuming GPUs - provided by the - [NVIDIA GPU Operator](https://github.com/NVIDIA/gpu-operator) - which can be installed on Kubernetes and also is made available - on OpenShift via OperatorHub. - instancetype.kubevirt.io/displayName: GPU NVIDIA + VMs of this instance type are assigned exclusive physical CPU cores, + avoiding CPU sharing and time-slice contention with other VMs. + instancetype.kubevirt.io/displayName: Dedicated vCPU labels: - instancetype.kubevirt.io/class: gpu.nvidia + instancetype.kubevirt.io/class: dedicated.vcpu + instancetype.kubevirt.io/cpu: "2" + instancetype.kubevirt.io/dedicatedCPUPlacement: "true" + instancetype.kubevirt.io/icon-pf: pficon-server-group + instancetype.kubevirt.io/isolateEmulatorThread: "true" + instancetype.kubevirt.io/memory: 8Gi + instancetype.kubevirt.io/size: large + instancetype.kubevirt.io/vendor: kubevirt.io + instancetype.kubevirt.io/version: "1" + name: d1.large +spec: + cpu: + dedicatedCPUPlacement: true + guest: 2 + isolateEmulatorThread: true + ioThreadsPolicy: auto + memory: + guest: 8Gi +--- +apiVersion: instancetype.kubevirt.io/v1beta1 +kind: VirtualMachineClusterInstancetype +metadata: + annotations: + instancetype.kubevirt.io/description: |- + The D Series is designed for consistent and predictable performance, + providing resources for general purpose applications. + + *D* is the abbreviation for "Dedicated", reflecting the use of + dedicated CPU placement for workloads. + + VMs of this instance type are assigned exclusive physical CPU cores, + avoiding CPU sharing and time-slice contention with other VMs. + instancetype.kubevirt.io/displayName: Dedicated vCPU + labels: + instancetype.kubevirt.io/class: dedicated.vcpu + instancetype.kubevirt.io/cpu: "1" + instancetype.kubevirt.io/dedicatedCPUPlacement: "true" + instancetype.kubevirt.io/icon-pf: pficon-server-group + instancetype.kubevirt.io/isolateEmulatorThread: "true" + instancetype.kubevirt.io/memory: 4Gi + instancetype.kubevirt.io/size: medium + instancetype.kubevirt.io/vendor: kubevirt.io + instancetype.kubevirt.io/version: "1" + name: d1.medium +spec: + cpu: + dedicatedCPUPlacement: true + guest: 1 + isolateEmulatorThread: true + ioThreadsPolicy: auto + memory: + guest: 4Gi +--- +apiVersion: instancetype.kubevirt.io/v1beta1 +kind: VirtualMachineClusterInstancetype +metadata: + annotations: + instancetype.kubevirt.io/description: |- + The D Series is designed for consistent and predictable performance, + providing resources for general purpose applications. + + *D* is the abbreviation for "Dedicated", reflecting the use of + dedicated CPU placement for workloads. + + VMs of this instance type are assigned exclusive physical CPU cores, + avoiding CPU sharing and time-slice contention with other VMs. + instancetype.kubevirt.io/displayName: Dedicated vCPU + labels: + instancetype.kubevirt.io/class: dedicated.vcpu + instancetype.kubevirt.io/cpu: "1" + instancetype.kubevirt.io/dedicatedCPUPlacement: "true" + instancetype.kubevirt.io/icon-pf: pficon-server-group + instancetype.kubevirt.io/isolateEmulatorThread: "true" + instancetype.kubevirt.io/memory: 1Gi + instancetype.kubevirt.io/size: micro + instancetype.kubevirt.io/vendor: kubevirt.io + instancetype.kubevirt.io/version: "1" + name: d1.micro +spec: + cpu: + dedicatedCPUPlacement: true + guest: 1 + isolateEmulatorThread: true + ioThreadsPolicy: auto + memory: + guest: 1Gi +--- +apiVersion: instancetype.kubevirt.io/v1beta1 +kind: VirtualMachineClusterInstancetype +metadata: + annotations: + instancetype.kubevirt.io/description: |- + The D Series is designed for consistent and predictable performance, + providing resources for general purpose applications. + + *D* is the abbreviation for "Dedicated", reflecting the use of + dedicated CPU placement for workloads. + + VMs of this instance type are assigned exclusive physical CPU cores, + avoiding CPU sharing and time-slice contention with other VMs. + instancetype.kubevirt.io/displayName: Dedicated vCPU + labels: + instancetype.kubevirt.io/class: dedicated.vcpu + instancetype.kubevirt.io/cpu: "1" + instancetype.kubevirt.io/dedicatedCPUPlacement: "true" + instancetype.kubevirt.io/icon-pf: pficon-server-group + instancetype.kubevirt.io/isolateEmulatorThread: "true" + instancetype.kubevirt.io/memory: 512Mi + instancetype.kubevirt.io/size: nano + instancetype.kubevirt.io/vendor: kubevirt.io + instancetype.kubevirt.io/version: "1" + name: d1.nano +spec: + cpu: + dedicatedCPUPlacement: true + guest: 1 + isolateEmulatorThread: true + ioThreadsPolicy: auto + memory: + guest: 512Mi +--- +apiVersion: instancetype.kubevirt.io/v1beta1 +kind: VirtualMachineClusterInstancetype +metadata: + annotations: + instancetype.kubevirt.io/description: |- + The D Series is designed for consistent and predictable performance, + providing resources for general purpose applications. + + *D* is the abbreviation for "Dedicated", reflecting the use of + dedicated CPU placement for workloads. + + VMs of this instance type are assigned exclusive physical CPU cores, + avoiding CPU sharing and time-slice contention with other VMs. + instancetype.kubevirt.io/displayName: Dedicated vCPU + labels: + instancetype.kubevirt.io/class: dedicated.vcpu + instancetype.kubevirt.io/cpu: "1" + instancetype.kubevirt.io/dedicatedCPUPlacement: "true" + instancetype.kubevirt.io/icon-pf: pficon-server-group + instancetype.kubevirt.io/isolateEmulatorThread: "true" + instancetype.kubevirt.io/memory: 2Gi + instancetype.kubevirt.io/size: small + instancetype.kubevirt.io/vendor: kubevirt.io + instancetype.kubevirt.io/version: "1" + name: d1.small +spec: + cpu: + dedicatedCPUPlacement: true + guest: 1 + isolateEmulatorThread: true + ioThreadsPolicy: auto + memory: + guest: 2Gi +--- +apiVersion: instancetype.kubevirt.io/v1beta1 +kind: VirtualMachineClusterInstancetype +metadata: + annotations: + instancetype.kubevirt.io/description: |- + The D Series is designed for consistent and predictable performance, + providing resources for general purpose applications. + + *D* is the abbreviation for "Dedicated", reflecting the use of + dedicated CPU placement for workloads. + + VMs of this instance type are assigned exclusive physical CPU cores, + avoiding CPU sharing and time-slice contention with other VMs. + instancetype.kubevirt.io/displayName: Dedicated vCPU + labels: + instancetype.kubevirt.io/class: dedicated.vcpu instancetype.kubevirt.io/cpu: "4" - instancetype.kubevirt.io/deprecated: "true" - instancetype.kubevirt.io/gpus: "true" - instancetype.kubevirt.io/icon-pf: fa-microchip + instancetype.kubevirt.io/dedicatedCPUPlacement: "true" + instancetype.kubevirt.io/icon-pf: pficon-server-group + instancetype.kubevirt.io/isolateEmulatorThread: "true" instancetype.kubevirt.io/memory: 16Gi instancetype.kubevirt.io/size: xlarge instancetype.kubevirt.io/vendor: kubevirt.io instancetype.kubevirt.io/version: "1" - name: gn1.xlarge + name: d1.xlarge spec: cpu: + dedicatedCPUPlacement: true guest: 4 - gpus: - - deviceName: nvidia.com/A400 - name: gpu1 + isolateEmulatorThread: true + ioThreadsPolicy: auto memory: guest: 16Gi --- @@ -413,7 +987,7 @@ metadata: labels: instancetype.kubevirt.io/class: memory.intensive instancetype.kubevirt.io/cpu: "8" - instancetype.kubevirt.io/hugepages: "true" + instancetype.kubevirt.io/hugepages: 2Mi instancetype.kubevirt.io/icon-pf: fa-memory instancetype.kubevirt.io/memory: 64Gi instancetype.kubevirt.io/size: 2xlarge @@ -439,9 +1013,37 @@ metadata: *M* is the abbreviation of "Memory". instancetype.kubevirt.io/displayName: Memory Intensive labels: + instancetype.kubevirt.io/class: memory.intensive + instancetype.kubevirt.io/cpu: "8" + instancetype.kubevirt.io/hugepages: 1Gi + instancetype.kubevirt.io/icon-pf: fa-memory + instancetype.kubevirt.io/memory: 64Gi + instancetype.kubevirt.io/size: 2xlarge1gi + instancetype.kubevirt.io/vendor: kubevirt.io + instancetype.kubevirt.io/version: "1" + name: m1.2xlarge1gi +spec: + cpu: + guest: 8 + memory: + guest: 64Gi + hugepages: + pageSize: 1Gi +--- +apiVersion: instancetype.kubevirt.io/v1beta1 +kind: VirtualMachineClusterInstancetype +metadata: + annotations: + instancetype.kubevirt.io/description: |- + The M Series provides resources for memory intensive + applications. + + *M* is the abbreviation of "Memory". + instancetype.kubevirt.io/displayName: Memory Intensive + labels: instancetype.kubevirt.io/class: memory.intensive instancetype.kubevirt.io/cpu: "16" - instancetype.kubevirt.io/hugepages: "true" + instancetype.kubevirt.io/hugepages: 2Mi instancetype.kubevirt.io/icon-pf: fa-memory instancetype.kubevirt.io/memory: 128Gi instancetype.kubevirt.io/size: 4xlarge @@ -467,9 +1069,37 @@ metadata: *M* is the abbreviation of "Memory". instancetype.kubevirt.io/displayName: Memory Intensive labels: + instancetype.kubevirt.io/class: memory.intensive + instancetype.kubevirt.io/cpu: "16" + instancetype.kubevirt.io/hugepages: 1Gi + instancetype.kubevirt.io/icon-pf: fa-memory + instancetype.kubevirt.io/memory: 128Gi + instancetype.kubevirt.io/size: 4xlarge1gi + instancetype.kubevirt.io/vendor: kubevirt.io + instancetype.kubevirt.io/version: "1" + name: m1.4xlarge1gi +spec: + cpu: + guest: 16 + memory: + guest: 128Gi + hugepages: + pageSize: 1Gi +--- +apiVersion: instancetype.kubevirt.io/v1beta1 +kind: VirtualMachineClusterInstancetype +metadata: + annotations: + instancetype.kubevirt.io/description: |- + The M Series provides resources for memory intensive + applications. + + *M* is the abbreviation of "Memory". + instancetype.kubevirt.io/displayName: Memory Intensive + labels: instancetype.kubevirt.io/class: memory.intensive instancetype.kubevirt.io/cpu: "32" - instancetype.kubevirt.io/hugepages: "true" + instancetype.kubevirt.io/hugepages: 2Mi instancetype.kubevirt.io/icon-pf: fa-memory instancetype.kubevirt.io/memory: 256Gi instancetype.kubevirt.io/size: 8xlarge @@ -495,9 +1125,37 @@ metadata: *M* is the abbreviation of "Memory". instancetype.kubevirt.io/displayName: Memory Intensive labels: + instancetype.kubevirt.io/class: memory.intensive + instancetype.kubevirt.io/cpu: "32" + instancetype.kubevirt.io/hugepages: 1Gi + instancetype.kubevirt.io/icon-pf: fa-memory + instancetype.kubevirt.io/memory: 256Gi + instancetype.kubevirt.io/size: 8xlarge1gi + instancetype.kubevirt.io/vendor: kubevirt.io + instancetype.kubevirt.io/version: "1" + name: m1.8xlarge1gi +spec: + cpu: + guest: 32 + memory: + guest: 256Gi + hugepages: + pageSize: 1Gi +--- +apiVersion: instancetype.kubevirt.io/v1beta1 +kind: VirtualMachineClusterInstancetype +metadata: + annotations: + instancetype.kubevirt.io/description: |- + The M Series provides resources for memory intensive + applications. + + *M* is the abbreviation of "Memory". + instancetype.kubevirt.io/displayName: Memory Intensive + labels: instancetype.kubevirt.io/class: memory.intensive instancetype.kubevirt.io/cpu: "2" - instancetype.kubevirt.io/hugepages: "true" + instancetype.kubevirt.io/hugepages: 2Mi instancetype.kubevirt.io/icon-pf: fa-memory instancetype.kubevirt.io/memory: 16Gi instancetype.kubevirt.io/size: large @@ -523,9 +1181,37 @@ metadata: *M* is the abbreviation of "Memory". instancetype.kubevirt.io/displayName: Memory Intensive labels: + instancetype.kubevirt.io/class: memory.intensive + instancetype.kubevirt.io/cpu: "2" + instancetype.kubevirt.io/hugepages: 1Gi + instancetype.kubevirt.io/icon-pf: fa-memory + instancetype.kubevirt.io/memory: 16Gi + instancetype.kubevirt.io/size: large1gi + instancetype.kubevirt.io/vendor: kubevirt.io + instancetype.kubevirt.io/version: "1" + name: m1.large1gi +spec: + cpu: + guest: 2 + memory: + guest: 16Gi + hugepages: + pageSize: 1Gi +--- +apiVersion: instancetype.kubevirt.io/v1beta1 +kind: VirtualMachineClusterInstancetype +metadata: + annotations: + instancetype.kubevirt.io/description: |- + The M Series provides resources for memory intensive + applications. + + *M* is the abbreviation of "Memory". + instancetype.kubevirt.io/displayName: Memory Intensive + labels: instancetype.kubevirt.io/class: memory.intensive instancetype.kubevirt.io/cpu: "4" - instancetype.kubevirt.io/hugepages: "true" + instancetype.kubevirt.io/hugepages: 2Mi instancetype.kubevirt.io/icon-pf: fa-memory instancetype.kubevirt.io/memory: 32Gi instancetype.kubevirt.io/size: xlarge @@ -542,6 +1228,34 @@ spec: --- apiVersion: instancetype.kubevirt.io/v1beta1 kind: VirtualMachineClusterInstancetype +metadata: + annotations: + instancetype.kubevirt.io/description: |- + The M Series provides resources for memory intensive + applications. + + *M* is the abbreviation of "Memory". + instancetype.kubevirt.io/displayName: Memory Intensive + labels: + instancetype.kubevirt.io/class: memory.intensive + instancetype.kubevirt.io/cpu: "4" + instancetype.kubevirt.io/hugepages: 1Gi + instancetype.kubevirt.io/icon-pf: fa-memory + instancetype.kubevirt.io/memory: 32Gi + instancetype.kubevirt.io/size: xlarge1gi + instancetype.kubevirt.io/vendor: kubevirt.io + instancetype.kubevirt.io/version: "1" + name: m1.xlarge1gi +spec: + cpu: + guest: 4 + memory: + guest: 32Gi + hugepages: + pageSize: 1Gi +--- +apiVersion: instancetype.kubevirt.io/v1beta1 +kind: VirtualMachineClusterInstancetype metadata: annotations: instancetype.kubevirt.io/description: |- @@ -558,7 +1272,7 @@ metadata: instancetype.kubevirt.io/class: network instancetype.kubevirt.io/cpu: "16" instancetype.kubevirt.io/dedicatedCPUPlacement: "true" - instancetype.kubevirt.io/hugepages: "true" + instancetype.kubevirt.io/hugepages: 1Gi instancetype.kubevirt.io/icon-pf: pficon-network instancetype.kubevirt.io/isolateEmulatorThread: "true" instancetype.kubevirt.io/memory: 32Gi @@ -598,7 +1312,7 @@ metadata: instancetype.kubevirt.io/class: network instancetype.kubevirt.io/cpu: "32" instancetype.kubevirt.io/dedicatedCPUPlacement: "true" - instancetype.kubevirt.io/hugepages: "true" + instancetype.kubevirt.io/hugepages: 1Gi instancetype.kubevirt.io/icon-pf: pficon-network instancetype.kubevirt.io/isolateEmulatorThread: "true" instancetype.kubevirt.io/memory: 64Gi @@ -638,7 +1352,7 @@ metadata: instancetype.kubevirt.io/class: network instancetype.kubevirt.io/cpu: "64" instancetype.kubevirt.io/dedicatedCPUPlacement: "true" - instancetype.kubevirt.io/hugepages: "true" + instancetype.kubevirt.io/hugepages: 1Gi instancetype.kubevirt.io/icon-pf: pficon-network instancetype.kubevirt.io/isolateEmulatorThread: "true" instancetype.kubevirt.io/memory: 128Gi @@ -678,7 +1392,7 @@ metadata: instancetype.kubevirt.io/class: network instancetype.kubevirt.io/cpu: "4" instancetype.kubevirt.io/dedicatedCPUPlacement: "true" - instancetype.kubevirt.io/hugepages: "true" + instancetype.kubevirt.io/hugepages: 1Gi instancetype.kubevirt.io/icon-pf: pficon-network instancetype.kubevirt.io/isolateEmulatorThread: "true" instancetype.kubevirt.io/memory: 8Gi @@ -718,7 +1432,7 @@ metadata: instancetype.kubevirt.io/class: network instancetype.kubevirt.io/cpu: "4" instancetype.kubevirt.io/dedicatedCPUPlacement: "true" - instancetype.kubevirt.io/hugepages: "true" + instancetype.kubevirt.io/hugepages: 1Gi instancetype.kubevirt.io/icon-pf: pficon-network instancetype.kubevirt.io/isolateEmulatorThread: "true" instancetype.kubevirt.io/memory: 4Gi @@ -758,7 +1472,7 @@ metadata: instancetype.kubevirt.io/class: network instancetype.kubevirt.io/cpu: "8" instancetype.kubevirt.io/dedicatedCPUPlacement: "true" - instancetype.kubevirt.io/hugepages: "true" + instancetype.kubevirt.io/hugepages: 1Gi instancetype.kubevirt.io/icon-pf: pficon-network instancetype.kubevirt.io/isolateEmulatorThread: "true" instancetype.kubevirt.io/memory: 16Gi @@ -1030,7 +1744,7 @@ metadata: instancetype.kubevirt.io/class: realtime instancetype.kubevirt.io/cpu: "8" instancetype.kubevirt.io/dedicatedCPUPlacement: "true" - instancetype.kubevirt.io/hugepages: "true" + instancetype.kubevirt.io/hugepages: 1Gi instancetype.kubevirt.io/icon-pf: pficon-server-group instancetype.kubevirt.io/isolateEmulatorThread: "true" instancetype.kubevirt.io/memory: 32Gi @@ -1073,7 +1787,7 @@ metadata: instancetype.kubevirt.io/class: realtime instancetype.kubevirt.io/cpu: "16" instancetype.kubevirt.io/dedicatedCPUPlacement: "true" - instancetype.kubevirt.io/hugepages: "true" + instancetype.kubevirt.io/hugepages: 1Gi instancetype.kubevirt.io/icon-pf: pficon-server-group instancetype.kubevirt.io/isolateEmulatorThread: "true" instancetype.kubevirt.io/memory: 64Gi @@ -1116,7 +1830,7 @@ metadata: instancetype.kubevirt.io/class: realtime instancetype.kubevirt.io/cpu: "32" instancetype.kubevirt.io/dedicatedCPUPlacement: "true" - instancetype.kubevirt.io/hugepages: "true" + instancetype.kubevirt.io/hugepages: 1Gi instancetype.kubevirt.io/icon-pf: pficon-server-group instancetype.kubevirt.io/isolateEmulatorThread: "true" instancetype.kubevirt.io/memory: 128Gi @@ -1159,7 +1873,7 @@ metadata: instancetype.kubevirt.io/class: realtime instancetype.kubevirt.io/cpu: "2" instancetype.kubevirt.io/dedicatedCPUPlacement: "true" - instancetype.kubevirt.io/hugepages: "true" + instancetype.kubevirt.io/hugepages: 1Gi instancetype.kubevirt.io/icon-pf: pficon-server-group instancetype.kubevirt.io/isolateEmulatorThread: "true" instancetype.kubevirt.io/memory: 8Gi @@ -1202,7 +1916,7 @@ metadata: instancetype.kubevirt.io/class: realtime instancetype.kubevirt.io/cpu: "1" instancetype.kubevirt.io/dedicatedCPUPlacement: "true" - instancetype.kubevirt.io/hugepages: "true" + instancetype.kubevirt.io/hugepages: 1Gi instancetype.kubevirt.io/icon-pf: pficon-server-group instancetype.kubevirt.io/isolateEmulatorThread: "true" instancetype.kubevirt.io/memory: 4Gi @@ -1245,7 +1959,7 @@ metadata: instancetype.kubevirt.io/class: realtime instancetype.kubevirt.io/cpu: "1" instancetype.kubevirt.io/dedicatedCPUPlacement: "true" - instancetype.kubevirt.io/hugepages: "true" + instancetype.kubevirt.io/hugepages: 1Gi instancetype.kubevirt.io/icon-pf: pficon-server-group instancetype.kubevirt.io/isolateEmulatorThread: "true" instancetype.kubevirt.io/memory: 1Gi @@ -1288,7 +2002,7 @@ metadata: instancetype.kubevirt.io/class: realtime instancetype.kubevirt.io/cpu: "1" instancetype.kubevirt.io/dedicatedCPUPlacement: "true" - instancetype.kubevirt.io/hugepages: "true" + instancetype.kubevirt.io/hugepages: 1Gi instancetype.kubevirt.io/icon-pf: pficon-server-group instancetype.kubevirt.io/isolateEmulatorThread: "true" instancetype.kubevirt.io/memory: 2Gi @@ -1331,7 +2045,7 @@ metadata: instancetype.kubevirt.io/class: realtime instancetype.kubevirt.io/cpu: "4" instancetype.kubevirt.io/dedicatedCPUPlacement: "true" - instancetype.kubevirt.io/hugepages: "true" + instancetype.kubevirt.io/hugepages: 1Gi instancetype.kubevirt.io/icon-pf: pficon-server-group instancetype.kubevirt.io/isolateEmulatorThread: "true" instancetype.kubevirt.io/memory: 16Gi diff --git a/packages/system/kubevirt-instancetypes/templates/preferences.yaml b/packages/system/kubevirt-instancetypes/templates/preferences.yaml index 67af459ae..458d8bd7b 100644 --- a/packages/system/kubevirt-instancetypes/templates/preferences.yaml +++ b/packages/system/kubevirt-instancetypes/templates/preferences.yaml @@ -4,12 +4,16 @@ metadata: annotations: iconClass: icon-alpine openshift.io/display-name: Alpine - openshift.io/documentation-url: https://github.com/kubevirt/common-instancetypes + openshift.io/documentation-url: | + "https://github.com/kubevirt/common-instancetypes" openshift.io/provider-display-name: KubeVirt - openshift.io/support-url: https://github.com/kubevirt/common-instancetypes/issues + openshift.io/support-url: | + "https://github.com/kubevirt/common-instancetypes/issues" tags: hidden,kubevirt,alpine labels: instancetype.kubevirt.io/os-type: linux + instancetype.kubevirt.io/required-cpu: "1" + instancetype.kubevirt.io/required-memory: 512Mi instancetype.kubevirt.io/vendor: kubevirt.io name: alpine spec: @@ -18,6 +22,7 @@ spec: devices: preferredDiskBus: virtio preferredInterfaceModel: virtio + preferredRng: {} requirements: cpu: guest: 1 @@ -26,73 +31,20 @@ spec: --- apiVersion: instancetype.kubevirt.io/v1beta1 kind: VirtualMachineClusterPreference -metadata: - annotations: - iconClass: icon-centos - openshift.io/display-name: CentOS 7 - openshift.io/documentation-url: https://github.com/kubevirt/common-instancetypes - openshift.io/provider-display-name: KubeVirt - openshift.io/support-url: https://github.com/kubevirt/common-instancetypes/issues - tags: hidden,kubevirt,linux,centos-stream - labels: - instancetype.kubevirt.io/deprecated: "true" - instancetype.kubevirt.io/os-type: linux - instancetype.kubevirt.io/vendor: kubevirt.io - name: centos.7 -spec: - annotations: - vm.kubevirt.io/os: linux - devices: - preferredDiskBus: virtio - preferredInterfaceModel: virtio - requirements: - cpu: - guest: 1 - memory: - guest: 1Gi ---- -apiVersion: instancetype.kubevirt.io/v1beta1 -kind: VirtualMachineClusterPreference -metadata: - annotations: - iconClass: icon-centos - openshift.io/display-name: CentOS 7 - openshift.io/documentation-url: https://github.com/kubevirt/common-instancetypes - openshift.io/provider-display-name: KubeVirt - openshift.io/support-url: https://github.com/kubevirt/common-instancetypes/issues - tags: hidden,kubevirt,linux,centos-stream - labels: - instancetype.kubevirt.io/deprecated: "true" - instancetype.kubevirt.io/os-type: linux - instancetype.kubevirt.io/vendor: kubevirt.io - name: centos.7.desktop -spec: - annotations: - vm.kubevirt.io/os: linux - devices: - preferredAutoattachInputDevice: true - preferredDiskBus: virtio - preferredInputBus: virtio - preferredInputType: tablet - preferredInterfaceModel: virtio - requirements: - cpu: - guest: 1 - memory: - guest: 1Gi ---- -apiVersion: instancetype.kubevirt.io/v1beta1 -kind: VirtualMachineClusterPreference metadata: annotations: iconClass: icon-centos openshift.io/display-name: CentOS Stream 10 - openshift.io/documentation-url: https://github.com/kubevirt/common-instancetypes + openshift.io/documentation-url: | + "https://github.com/kubevirt/common-instancetypes" openshift.io/provider-display-name: KubeVirt - openshift.io/support-url: https://github.com/kubevirt/common-instancetypes/issues + openshift.io/support-url: | + "https://github.com/kubevirt/common-instancetypes/issues" tags: hidden,kubevirt,linux,centos-stream labels: instancetype.kubevirt.io/os-type: linux + instancetype.kubevirt.io/required-cpu: "1" + instancetype.kubevirt.io/required-memory: 1.5Gi instancetype.kubevirt.io/vendor: kubevirt.io name: centos.stream10 spec: @@ -115,12 +67,16 @@ metadata: annotations: iconClass: icon-centos openshift.io/display-name: CentOS Stream 10 - openshift.io/documentation-url: https://github.com/kubevirt/common-instancetypes + openshift.io/documentation-url: | + "https://github.com/kubevirt/common-instancetypes" openshift.io/provider-display-name: KubeVirt - openshift.io/support-url: https://github.com/kubevirt/common-instancetypes/issues + openshift.io/support-url: | + "https://github.com/kubevirt/common-instancetypes/issues" tags: hidden,kubevirt,linux,centos-stream labels: instancetype.kubevirt.io/os-type: linux + instancetype.kubevirt.io/required-cpu: "1" + instancetype.kubevirt.io/required-memory: 1.5Gi instancetype.kubevirt.io/vendor: kubevirt.io name: centos.stream10.desktop spec: @@ -142,106 +98,20 @@ spec: --- apiVersion: instancetype.kubevirt.io/v1beta1 kind: VirtualMachineClusterPreference -metadata: - annotations: - iconClass: icon-centos - openshift.io/display-name: CentOS Stream 8 - openshift.io/documentation-url: https://github.com/kubevirt/common-instancetypes - openshift.io/provider-display-name: KubeVirt - openshift.io/support-url: https://github.com/kubevirt/common-instancetypes/issues - tags: hidden,kubevirt,linux,centos-stream - labels: - instancetype.kubevirt.io/deprecated: "true" - instancetype.kubevirt.io/os-type: linux - instancetype.kubevirt.io/vendor: kubevirt.io - name: centos.stream8 -spec: - annotations: - vm.kubevirt.io/os: linux - devices: - preferredDiskBus: virtio - preferredInterfaceModel: virtio - requirements: - cpu: - guest: 1 - memory: - guest: 1.5Gi ---- -apiVersion: instancetype.kubevirt.io/v1beta1 -kind: VirtualMachineClusterPreference -metadata: - annotations: - iconClass: icon-centos - openshift.io/display-name: CentOS Stream 8 - openshift.io/documentation-url: https://github.com/kubevirt/common-instancetypes - openshift.io/provider-display-name: KubeVirt - openshift.io/support-url: https://github.com/kubevirt/common-instancetypes/issues - tags: hidden,kubevirt,linux,centos-stream - labels: - instancetype.kubevirt.io/deprecated: "true" - instancetype.kubevirt.io/os-type: linux - instancetype.kubevirt.io/vendor: kubevirt.io - name: centos.stream8.desktop -spec: - annotations: - vm.kubevirt.io/os: linux - devices: - preferredAutoattachInputDevice: true - preferredDiskBus: virtio - preferredInputBus: virtio - preferredInputType: tablet - preferredInterfaceModel: virtio - requirements: - cpu: - guest: 1 - memory: - guest: 1.5Gi ---- -apiVersion: instancetype.kubevirt.io/v1beta1 -kind: VirtualMachineClusterPreference -metadata: - annotations: - iconClass: icon-centos - openshift.io/display-name: CentOS Stream 8 - openshift.io/documentation-url: https://github.com/kubevirt/common-instancetypes - openshift.io/provider-display-name: KubeVirt - openshift.io/support-url: https://github.com/kubevirt/common-instancetypes/issues - tags: hidden,kubevirt,linux,centos-stream,dpdk - labels: - instancetype.kubevirt.io/deprecated: "true" - instancetype.kubevirt.io/os-type: linux - instancetype.kubevirt.io/vendor: kubevirt.io - name: centos.stream8.dpdk -spec: - annotations: - vm.kubevirt.io/os: linux - cpu: - preferredCPUTopology: spread - spreadOptions: - across: SocketsCoresThreads - ratio: 4 - devices: - preferredDiskBus: virtio - preferredInterfaceModel: virtio - preferredNetworkInterfaceMultiQueue: true - requirements: - cpu: - guest: 2 - memory: - guest: 1.5Gi ---- -apiVersion: instancetype.kubevirt.io/v1beta1 -kind: VirtualMachineClusterPreference metadata: annotations: iconClass: icon-centos openshift.io/display-name: CentOS Stream 9 - openshift.io/documentation-url: https://github.com/kubevirt/common-instancetypes + openshift.io/documentation-url: | + "https://github.com/kubevirt/common-instancetypes" openshift.io/provider-display-name: KubeVirt - openshift.io/support-url: https://github.com/kubevirt/common-instancetypes/issues + openshift.io/support-url: | + "https://github.com/kubevirt/common-instancetypes/issues" tags: hidden,kubevirt,linux,centos-stream labels: instancetype.kubevirt.io/os-type: linux + instancetype.kubevirt.io/required-cpu: "1" + instancetype.kubevirt.io/required-memory: 1.5Gi instancetype.kubevirt.io/vendor: kubevirt.io name: centos.stream9 spec: @@ -264,12 +134,16 @@ metadata: annotations: iconClass: icon-centos openshift.io/display-name: CentOS Stream 9 - openshift.io/documentation-url: https://github.com/kubevirt/common-instancetypes + openshift.io/documentation-url: | + "https://github.com/kubevirt/common-instancetypes" openshift.io/provider-display-name: KubeVirt - openshift.io/support-url: https://github.com/kubevirt/common-instancetypes/issues + openshift.io/support-url: | + "https://github.com/kubevirt/common-instancetypes/issues" tags: hidden,kubevirt,linux,centos-stream labels: instancetype.kubevirt.io/os-type: linux + instancetype.kubevirt.io/required-cpu: "1" + instancetype.kubevirt.io/required-memory: 1.5Gi instancetype.kubevirt.io/vendor: kubevirt.io name: centos.stream9.desktop spec: @@ -295,12 +169,16 @@ metadata: annotations: iconClass: icon-centos openshift.io/display-name: CentOS Stream 9 - openshift.io/documentation-url: https://github.com/kubevirt/common-instancetypes + openshift.io/documentation-url: | + "https://github.com/kubevirt/common-instancetypes" openshift.io/provider-display-name: KubeVirt - openshift.io/support-url: https://github.com/kubevirt/common-instancetypes/issues + openshift.io/support-url: | + "https://github.com/kubevirt/common-instancetypes/issues" tags: hidden,kubevirt,linux,centos-stream,dpdk labels: instancetype.kubevirt.io/os-type: linux + instancetype.kubevirt.io/required-cpu: "8" + instancetype.kubevirt.io/required-memory: 1.5Gi instancetype.kubevirt.io/vendor: kubevirt.io name: centos.stream9.dpdk spec: @@ -319,7 +197,7 @@ spec: preferredRng: {} requirements: cpu: - guest: 2 + guest: 8 memory: guest: 1.5Gi --- @@ -329,12 +207,16 @@ metadata: annotations: iconClass: icon-cirros openshift.io/display-name: Cirros - openshift.io/documentation-url: https://github.com/kubevirt/common-instancetypes + openshift.io/documentation-url: | + "https://github.com/kubevirt/common-instancetypes" openshift.io/provider-display-name: KubeVirt - openshift.io/support-url: https://github.com/kubevirt/common-instancetypes/issues + openshift.io/support-url: | + "https://github.com/kubevirt/common-instancetypes/issues" tags: hidden,kubevirt,cirros labels: instancetype.kubevirt.io/os-type: linux + instancetype.kubevirt.io/required-cpu: "1" + instancetype.kubevirt.io/required-memory: 256Mi instancetype.kubevirt.io/vendor: kubevirt.io name: cirros spec: @@ -343,6 +225,7 @@ spec: devices: preferredDiskBus: virtio preferredInterfaceModel: virtio + preferredRng: {} requirements: cpu: guest: 1 @@ -351,17 +234,57 @@ spec: --- apiVersion: instancetype.kubevirt.io/v1beta1 kind: VirtualMachineClusterPreference +metadata: + annotations: + iconClass: icon-debian + openshift.io/display-name: Debian + openshift.io/documentation-url: | + "https://github.com/kubevirt/common-instancetypes" + openshift.io/provider-display-name: KubeVirt + openshift.io/support-url: | + "https://github.com/kubevirt/common-instancetypes/issues" + tags: hidden,kubevirt,debian + labels: + instancetype.kubevirt.io/os-type: linux + instancetype.kubevirt.io/required-cpu: "1" + instancetype.kubevirt.io/required-memory: 512Mi + instancetype.kubevirt.io/vendor: kubevirt.io + name: debian +spec: + annotations: + vm.kubevirt.io/os: linux + devices: + preferredDiskBus: virtio + preferredInterfaceModel: virtio + preferredRng: {} + firmware: + preferredEfi: + secureBoot: false + requirements: + cpu: + guest: 1 + memory: + guest: 512Mi +--- +apiVersion: instancetype.kubevirt.io/v1beta1 +kind: VirtualMachineClusterPreference metadata: annotations: iconClass: icon-fedora openshift.io/display-name: Fedora (amd64) - openshift.io/documentation-url: https://github.com/kubevirt/common-instancetypes + openshift.io/documentation-url: | + "https://github.com/kubevirt/common-instancetypes" openshift.io/provider-display-name: KubeVirt - openshift.io/support-url: https://github.com/kubevirt/common-instancetypes/issues + openshift.io/support-url: | + "https://github.com/kubevirt/common-instancetypes/issues" tags: hidden,kubevirt,fedora labels: instancetype.kubevirt.io/arch: amd64 instancetype.kubevirt.io/os-type: linux + instancetype.kubevirt.io/preferred-architecture: amd64 + instancetype.kubevirt.io/required-architecture: amd64 + instancetype.kubevirt.io/required-cpu: "1" + instancetype.kubevirt.io/required-memory: 2Gi instancetype.kubevirt.io/vendor: kubevirt.io name: fedora spec: @@ -370,14 +293,15 @@ spec: devices: preferredDiskBus: virtio preferredInterfaceModel: virtio - preferredNetworkInterfaceMultiQueue: true preferredRng: {} features: preferredSmm: {} firmware: preferredEfi: secureBoot: true + preferredArchitecture: amd64 requirements: + architecture: amd64 cpu: guest: 1 memory: @@ -389,13 +313,19 @@ metadata: annotations: iconClass: icon-fedora openshift.io/display-name: Fedora (arm64) - openshift.io/documentation-url: https://github.com/kubevirt/common-instancetypes + openshift.io/documentation-url: | + "https://github.com/kubevirt/common-instancetypes" openshift.io/provider-display-name: KubeVirt - openshift.io/support-url: https://github.com/kubevirt/common-instancetypes/issues + openshift.io/support-url: | + "https://github.com/kubevirt/common-instancetypes/issues" tags: hidden,kubevirt,fedora labels: instancetype.kubevirt.io/arch: arm64 instancetype.kubevirt.io/os-type: linux + instancetype.kubevirt.io/preferred-architecture: arm64 + instancetype.kubevirt.io/required-architecture: arm64 + instancetype.kubevirt.io/required-cpu: "1" + instancetype.kubevirt.io/required-memory: 2Gi instancetype.kubevirt.io/vendor: kubevirt.io name: fedora.arm64 spec: @@ -404,9 +334,10 @@ spec: devices: preferredDiskBus: virtio preferredInterfaceModel: virtio - preferredNetworkInterfaceMultiQueue: true preferredRng: {} + preferredArchitecture: arm64 requirements: + architecture: arm64 cpu: guest: 1 memory: @@ -414,16 +345,155 @@ spec: --- apiVersion: instancetype.kubevirt.io/v1beta1 kind: VirtualMachineClusterPreference +metadata: + annotations: + iconClass: icon-fedora + openshift.io/display-name: Fedora (s390x) + openshift.io/documentation-url: | + "https://github.com/kubevirt/common-instancetypes" + openshift.io/provider-display-name: KubeVirt + openshift.io/support-url: | + "https://github.com/kubevirt/common-instancetypes/issues" + tags: hidden,kubevirt,fedora + labels: + instancetype.kubevirt.io/arch: s390x + instancetype.kubevirt.io/os-type: linux + instancetype.kubevirt.io/preferred-architecture: s390x + instancetype.kubevirt.io/required-architecture: s390x + instancetype.kubevirt.io/required-cpu: "1" + instancetype.kubevirt.io/required-memory: 2Gi + instancetype.kubevirt.io/vendor: kubevirt.io + name: fedora.s390x +spec: + annotations: + vm.kubevirt.io/os: linux + devices: + preferredDiskBus: virtio + preferredInterfaceModel: virtio + preferredRng: {} + preferredArchitecture: s390x + requirements: + architecture: s390x + cpu: + guest: 1 + memory: + guest: 2Gi +--- +apiVersion: instancetype.kubevirt.io/v1beta1 +kind: VirtualMachineClusterPreference +metadata: + annotations: + iconClass: icon-other + openshift.io/display-name: Legacy Guest + openshift.io/documentation-url: | + "https://github.com/kubevirt/common-instancetypes" + openshift.io/provider-display-name: KubeVirt + openshift.io/support-url: | + "https://github.com/kubevirt/common-instancetypes/issues" + tags: hidden,kubevirt,legacy + labels: + instancetype.kubevirt.io/os-type: legacy + instancetype.kubevirt.io/vendor: kubevirt.io + name: legacy +spec: + annotations: + vm.kubevirt.io/os: legacy + devices: + preferredDiskBus: sata + preferredInterfaceModel: e1000 +--- +apiVersion: instancetype.kubevirt.io/v1beta1 +kind: VirtualMachineClusterPreference +metadata: + annotations: + iconClass: icon-linux + openshift.io/display-name: Linux Guest + openshift.io/documentation-url: | + "https://github.com/kubevirt/common-instancetypes" + openshift.io/provider-display-name: KubeVirt + openshift.io/support-url: | + "https://github.com/kubevirt/common-instancetypes/issues" + tags: hidden,kubevirt,linux + labels: + instancetype.kubevirt.io/os-type: linux + instancetype.kubevirt.io/vendor: kubevirt.io + name: linux +spec: + annotations: + vm.kubevirt.io/os: linux + devices: + preferredDiskBus: virtio + preferredInterfaceModel: virtio + preferredRng: {} +--- +apiVersion: instancetype.kubevirt.io/v1beta1 +kind: VirtualMachineClusterPreference +metadata: + annotations: + iconClass: icon-linux + openshift.io/display-name: Linux EFI Guest + openshift.io/documentation-url: | + "https://github.com/kubevirt/common-instancetypes" + openshift.io/provider-display-name: KubeVirt + openshift.io/support-url: | + "https://github.com/kubevirt/common-instancetypes/issues" + tags: hidden,kubevirt,linux-efi + labels: + instancetype.kubevirt.io/os-type: linux + instancetype.kubevirt.io/vendor: kubevirt.io + name: linux.efi +spec: + annotations: + vm.kubevirt.io/os: linux + devices: + preferredDiskBus: virtio + preferredInterfaceModel: virtio + preferredRng: {} + firmware: + preferredEfi: + secureBoot: false +--- +apiVersion: instancetype.kubevirt.io/v1beta1 +kind: VirtualMachineClusterPreference +metadata: + annotations: + iconClass: icon-linux + openshift.io/display-name: Linux Virtio Transitional Guest + openshift.io/documentation-url: | + "https://github.com/kubevirt/common-instancetypes" + openshift.io/provider-display-name: KubeVirt + openshift.io/support-url: | + "https://github.com/kubevirt/common-instancetypes/issues" + tags: hidden,kubevirt,linux-virtio-transitional + labels: + instancetype.kubevirt.io/os-type: linux + instancetype.kubevirt.io/vendor: kubevirt.io + name: linux.virtiotransitional +spec: + annotations: + vm.kubevirt.io/os: linux + devices: + preferredDiskBus: virtio + preferredInterfaceModel: virtio + preferredRng: {} + preferredUseVirtioTransitional: true +--- +apiVersion: instancetype.kubevirt.io/v1beta1 +kind: VirtualMachineClusterPreference metadata: annotations: iconClass: icon-opensuse-leap openshift.io/display-name: OpenSUSE Leap - openshift.io/documentation-url: https://github.com/kubevirt/common-instancetypes + openshift.io/documentation-url: | + "https://github.com/kubevirt/common-instancetypes" openshift.io/provider-display-name: KubeVirt - openshift.io/support-url: https://github.com/kubevirt/common-instancetypes/issues + openshift.io/support-url: | + "https://github.com/kubevirt/common-instancetypes/issues" tags: hidden,kubevirt,opensuse.leap labels: instancetype.kubevirt.io/os-type: linux + instancetype.kubevirt.io/required-cpu: "1" + instancetype.kubevirt.io/required-memory: 2Gi instancetype.kubevirt.io/vendor: kubevirt.io name: opensuse.leap spec: @@ -445,12 +515,16 @@ metadata: annotations: iconClass: icon-opensuse-tumbleweed openshift.io/display-name: OpenSUSE Tumbleweed - openshift.io/documentation-url: https://github.com/kubevirt/common-instancetypes + openshift.io/documentation-url: | + "https://github.com/kubevirt/common-instancetypes" openshift.io/provider-display-name: KubeVirt - openshift.io/support-url: https://github.com/kubevirt/common-instancetypes/issues + openshift.io/support-url: | + "https://github.com/kubevirt/common-instancetypes/issues" tags: hidden,kubevirt,opensuse.tumbleweed labels: instancetype.kubevirt.io/os-type: linux + instancetype.kubevirt.io/required-cpu: "1" + instancetype.kubevirt.io/required-memory: 2Gi instancetype.kubevirt.io/vendor: kubevirt.io name: opensuse.tumbleweed spec: @@ -470,15 +544,55 @@ apiVersion: instancetype.kubevirt.io/v1beta1 kind: VirtualMachineClusterPreference metadata: annotations: - iconClass: icon-rhel - openshift.io/display-name: Red Hat Enterprise Linux 10 Beta (amd64) - openshift.io/documentation-url: https://github.com/kubevirt/common-instancetypes + iconClass: icon-oracle + openshift.io/display-name: Oracle Linux + openshift.io/documentation-url: | + "https://github.com/kubevirt/common-instancetypes" openshift.io/provider-display-name: KubeVirt - openshift.io/support-url: https://github.com/kubevirt/common-instancetypes/issues + openshift.io/support-url: | + "https://github.com/kubevirt/common-instancetypes/issues" + tags: hidden,kubevirt,oraclelinux + labels: + instancetype.kubevirt.io/os-type: linux + instancetype.kubevirt.io/required-cpu: "2" + instancetype.kubevirt.io/required-memory: 4Gi + instancetype.kubevirt.io/vendor: kubevirt.io + name: oraclelinux +spec: + annotations: + vm.kubevirt.io/os: linux + devices: + preferredDiskBus: virtio + preferredInterfaceModel: virtio + preferredRng: {} + firmware: + preferredEfi: + secureBoot: false + requirements: + cpu: + guest: 2 + memory: + guest: 4Gi +--- +apiVersion: instancetype.kubevirt.io/v1beta1 +kind: VirtualMachineClusterPreference +metadata: + annotations: + iconClass: icon-rhel + openshift.io/display-name: Red Hat Enterprise Linux 10 (amd64) + openshift.io/documentation-url: | + "https://github.com/kubevirt/common-instancetypes" + openshift.io/provider-display-name: KubeVirt + openshift.io/support-url: | + "https://github.com/kubevirt/common-instancetypes/issues" tags: hidden,kubevirt,linux,rhel labels: instancetype.kubevirt.io/arch: amd64 instancetype.kubevirt.io/os-type: linux + instancetype.kubevirt.io/preferred-architecture: amd64 + instancetype.kubevirt.io/required-architecture: amd64 + instancetype.kubevirt.io/required-cpu: "1" + instancetype.kubevirt.io/required-memory: 1.5Gi instancetype.kubevirt.io/vendor: kubevirt.io name: rhel.10 spec: @@ -494,7 +608,9 @@ spec: firmware: preferredEfi: secureBoot: true + preferredArchitecture: amd64 requirements: + architecture: amd64 cpu: guest: 1 memory: @@ -505,14 +621,20 @@ kind: VirtualMachineClusterPreference metadata: annotations: iconClass: icon-rhel - openshift.io/display-name: Red Hat Enterprise Linux 10 Beta (arm64) - openshift.io/documentation-url: https://github.com/kubevirt/common-instancetypes + openshift.io/display-name: Red Hat Enterprise Linux 10 (arm64) + openshift.io/documentation-url: | + "https://github.com/kubevirt/common-instancetypes" openshift.io/provider-display-name: KubeVirt - openshift.io/support-url: https://github.com/kubevirt/common-instancetypes/issues + openshift.io/support-url: | + "https://github.com/kubevirt/common-instancetypes/issues" tags: hidden,kubevirt,linux,rhel labels: instancetype.kubevirt.io/arch: arm64 instancetype.kubevirt.io/os-type: linux + instancetype.kubevirt.io/preferred-architecture: arm64 + instancetype.kubevirt.io/required-architecture: arm64 + instancetype.kubevirt.io/required-cpu: "1" + instancetype.kubevirt.io/required-memory: 1.5Gi instancetype.kubevirt.io/vendor: kubevirt.io name: rhel.10.arm64 spec: @@ -523,6 +645,141 @@ spec: preferredDiskDedicatedIoThread: true preferredInterfaceModel: virtio preferredRng: {} + preferredArchitecture: arm64 + requirements: + architecture: arm64 + cpu: + guest: 1 + memory: + guest: 1.5Gi +--- +apiVersion: instancetype.kubevirt.io/v1beta1 +kind: VirtualMachineClusterPreference +metadata: + annotations: + iconClass: icon-rhel + openshift.io/display-name: Red Hat Enterprise Linux 10 (s390x) + openshift.io/documentation-url: | + "https://github.com/kubevirt/common-instancetypes" + openshift.io/provider-display-name: KubeVirt + openshift.io/support-url: | + "https://github.com/kubevirt/common-instancetypes/issues" + tags: hidden,kubevirt,linux,rhel + labels: + instancetype.kubevirt.io/arch: s390x + instancetype.kubevirt.io/os-type: linux + instancetype.kubevirt.io/preferred-architecture: s390x + instancetype.kubevirt.io/required-architecture: s390x + instancetype.kubevirt.io/required-cpu: "1" + instancetype.kubevirt.io/required-memory: 1.5Gi + instancetype.kubevirt.io/vendor: kubevirt.io + name: rhel.10.s390x +spec: + annotations: + vm.kubevirt.io/os: linux + devices: + preferredDiskBus: virtio + preferredDiskDedicatedIoThread: true + preferredInterfaceModel: virtio + preferredRng: {} + preferredArchitecture: s390x + requirements: + architecture: s390x + cpu: + guest: 1 + memory: + guest: 1.5Gi +--- +apiVersion: instancetype.kubevirt.io/v1beta1 +kind: VirtualMachineClusterPreference +metadata: + annotations: + iconClass: icon-rhel + openshift.io/display-name: Red Hat Enterprise Linux 7 + openshift.io/documentation-url: | + "https://github.com/kubevirt/common-instancetypes" + openshift.io/provider-display-name: KubeVirt + openshift.io/support-url: | + "https://github.com/kubevirt/common-instancetypes/issues" + tags: hidden,kubevirt,linux,rhel + labels: + instancetype.kubevirt.io/os-type: linux + instancetype.kubevirt.io/required-cpu: "1" + instancetype.kubevirt.io/required-memory: 1Gi + instancetype.kubevirt.io/vendor: kubevirt.io + name: rhel.7 +spec: + annotations: + vm.kubevirt.io/os: linux + devices: + preferredDiskBus: virtio + preferredInterfaceModel: virtio + preferredRng: {} + requirements: + cpu: + guest: 1 + memory: + guest: 1Gi +--- +apiVersion: instancetype.kubevirt.io/v1beta1 +kind: VirtualMachineClusterPreference +metadata: + annotations: + iconClass: icon-rhel + openshift.io/display-name: Red Hat Enterprise Linux 7 + openshift.io/documentation-url: | + "https://github.com/kubevirt/common-instancetypes" + openshift.io/provider-display-name: KubeVirt + openshift.io/support-url: | + "https://github.com/kubevirt/common-instancetypes/issues" + tags: hidden,kubevirt,linux,rhel + labels: + instancetype.kubevirt.io/os-type: linux + instancetype.kubevirt.io/required-cpu: "1" + instancetype.kubevirt.io/required-memory: 1Gi + instancetype.kubevirt.io/vendor: kubevirt.io + name: rhel.7.desktop +spec: + annotations: + vm.kubevirt.io/os: linux + devices: + preferredAutoattachInputDevice: true + preferredDiskBus: virtio + preferredInputBus: virtio + preferredInputType: tablet + preferredInterfaceModel: virtio + preferredRng: {} + requirements: + cpu: + guest: 1 + memory: + guest: 1Gi +--- +apiVersion: instancetype.kubevirt.io/v1beta1 +kind: VirtualMachineClusterPreference +metadata: + annotations: + iconClass: icon-rhel + openshift.io/display-name: Red Hat Enterprise Linux 8 + openshift.io/documentation-url: | + "https://github.com/kubevirt/common-instancetypes" + openshift.io/provider-display-name: KubeVirt + openshift.io/support-url: | + "https://github.com/kubevirt/common-instancetypes/issues" + tags: hidden,kubevirt,linux,rhel + labels: + instancetype.kubevirt.io/os-type: linux + instancetype.kubevirt.io/required-cpu: "1" + instancetype.kubevirt.io/required-memory: 1.5Gi + instancetype.kubevirt.io/vendor: kubevirt.io + name: rhel.8 +spec: + annotations: + vm.kubevirt.io/os: linux + devices: + preferredDiskBus: virtio + preferredInterfaceModel: virtio + preferredRng: {} requirements: cpu: guest: 1 @@ -531,97 +788,20 @@ spec: --- apiVersion: instancetype.kubevirt.io/v1beta1 kind: VirtualMachineClusterPreference -metadata: - annotations: - iconClass: icon-rhel - openshift.io/display-name: Red Hat Enterprise Linux 7 - openshift.io/documentation-url: https://github.com/kubevirt/common-instancetypes - openshift.io/provider-display-name: KubeVirt - openshift.io/support-url: https://github.com/kubevirt/common-instancetypes/issues - tags: hidden,kubevirt,linux,rhel - labels: - instancetype.kubevirt.io/os-type: linux - instancetype.kubevirt.io/vendor: kubevirt.io - name: rhel.7 -spec: - annotations: - vm.kubevirt.io/os: linux - devices: - preferredDiskBus: virtio - preferredInterfaceModel: virtio - requirements: - cpu: - guest: 1 - memory: - guest: 1Gi ---- -apiVersion: instancetype.kubevirt.io/v1beta1 -kind: VirtualMachineClusterPreference -metadata: - annotations: - iconClass: icon-rhel - openshift.io/display-name: Red Hat Enterprise Linux 7 - openshift.io/documentation-url: https://github.com/kubevirt/common-instancetypes - openshift.io/provider-display-name: KubeVirt - openshift.io/support-url: https://github.com/kubevirt/common-instancetypes/issues - tags: hidden,kubevirt,linux,rhel - labels: - instancetype.kubevirt.io/os-type: linux - instancetype.kubevirt.io/vendor: kubevirt.io - name: rhel.7.desktop -spec: - annotations: - vm.kubevirt.io/os: linux - devices: - preferredAutoattachInputDevice: true - preferredDiskBus: virtio - preferredInputBus: virtio - preferredInputType: tablet - preferredInterfaceModel: virtio - requirements: - cpu: - guest: 1 - memory: - guest: 1Gi ---- -apiVersion: instancetype.kubevirt.io/v1beta1 -kind: VirtualMachineClusterPreference metadata: annotations: iconClass: icon-rhel openshift.io/display-name: Red Hat Enterprise Linux 8 - openshift.io/documentation-url: https://github.com/kubevirt/common-instancetypes + openshift.io/documentation-url: | + "https://github.com/kubevirt/common-instancetypes" openshift.io/provider-display-name: KubeVirt - openshift.io/support-url: https://github.com/kubevirt/common-instancetypes/issues - tags: hidden,kubevirt,linux,rhel - labels: - instancetype.kubevirt.io/os-type: linux - instancetype.kubevirt.io/vendor: kubevirt.io - name: rhel.8 -spec: - annotations: - vm.kubevirt.io/os: linux - devices: - preferredDiskBus: virtio - preferredInterfaceModel: virtio - requirements: - cpu: - guest: 1 - memory: - guest: 1.5Gi ---- -apiVersion: instancetype.kubevirt.io/v1beta1 -kind: VirtualMachineClusterPreference -metadata: - annotations: - iconClass: icon-rhel - openshift.io/display-name: Red Hat Enterprise Linux 8 - openshift.io/documentation-url: https://github.com/kubevirt/common-instancetypes - openshift.io/provider-display-name: KubeVirt - openshift.io/support-url: https://github.com/kubevirt/common-instancetypes/issues + openshift.io/support-url: | + "https://github.com/kubevirt/common-instancetypes/issues" tags: hidden,kubevirt,linux,rhel labels: instancetype.kubevirt.io/os-type: linux + instancetype.kubevirt.io/required-cpu: "1" + instancetype.kubevirt.io/required-memory: 1.5Gi instancetype.kubevirt.io/vendor: kubevirt.io name: rhel.8.desktop spec: @@ -633,6 +813,7 @@ spec: preferredInputBus: virtio preferredInputType: tablet preferredInterfaceModel: virtio + preferredRng: {} requirements: cpu: guest: 1 @@ -645,12 +826,16 @@ metadata: annotations: iconClass: icon-rhel openshift.io/display-name: Red Hat Enterprise Linux 8 - openshift.io/documentation-url: https://github.com/kubevirt/common-instancetypes + openshift.io/documentation-url: | + "https://github.com/kubevirt/common-instancetypes" openshift.io/provider-display-name: KubeVirt - openshift.io/support-url: https://github.com/kubevirt/common-instancetypes/issues + openshift.io/support-url: | + "https://github.com/kubevirt/common-instancetypes/issues" tags: hidden,kubevirt,linux,rhel,dpdk labels: instancetype.kubevirt.io/os-type: linux + instancetype.kubevirt.io/required-cpu: "8" + instancetype.kubevirt.io/required-memory: 1.5Gi instancetype.kubevirt.io/vendor: kubevirt.io name: rhel.8.dpdk spec: @@ -665,9 +850,10 @@ spec: preferredDiskBus: virtio preferredInterfaceModel: virtio preferredNetworkInterfaceMultiQueue: true + preferredRng: {} requirements: cpu: - guest: 2 + guest: 8 memory: guest: 1.5Gi --- @@ -677,13 +863,19 @@ metadata: annotations: iconClass: icon-rhel openshift.io/display-name: Red Hat Enterprise Linux 9 (amd64) - openshift.io/documentation-url: https://github.com/kubevirt/common-instancetypes + openshift.io/documentation-url: | + "https://github.com/kubevirt/common-instancetypes" openshift.io/provider-display-name: KubeVirt - openshift.io/support-url: https://github.com/kubevirt/common-instancetypes/issues + openshift.io/support-url: | + "https://github.com/kubevirt/common-instancetypes/issues" tags: hidden,kubevirt,linux,rhel labels: instancetype.kubevirt.io/arch: amd64 instancetype.kubevirt.io/os-type: linux + instancetype.kubevirt.io/preferred-architecture: amd64 + instancetype.kubevirt.io/required-architecture: amd64 + instancetype.kubevirt.io/required-cpu: "1" + instancetype.kubevirt.io/required-memory: 1.5Gi instancetype.kubevirt.io/vendor: kubevirt.io name: rhel.9 spec: @@ -699,7 +891,9 @@ spec: firmware: preferredEfi: secureBoot: true + preferredArchitecture: amd64 requirements: + architecture: amd64 cpu: guest: 1 memory: @@ -711,13 +905,19 @@ metadata: annotations: iconClass: icon-rhel openshift.io/display-name: Red Hat Enterprise Linux 9 (arm64) - openshift.io/documentation-url: https://github.com/kubevirt/common-instancetypes + openshift.io/documentation-url: | + "https://github.com/kubevirt/common-instancetypes" openshift.io/provider-display-name: KubeVirt - openshift.io/support-url: https://github.com/kubevirt/common-instancetypes/issues + openshift.io/support-url: | + "https://github.com/kubevirt/common-instancetypes/issues" tags: hidden,kubevirt,linux,rhel labels: instancetype.kubevirt.io/arch: arm64 instancetype.kubevirt.io/os-type: linux + instancetype.kubevirt.io/preferred-architecture: arm64 + instancetype.kubevirt.io/required-architecture: arm64 + instancetype.kubevirt.io/required-cpu: "1" + instancetype.kubevirt.io/required-memory: 1.5Gi instancetype.kubevirt.io/vendor: kubevirt.io name: rhel.9.arm64 spec: @@ -728,7 +928,9 @@ spec: preferredDiskDedicatedIoThread: true preferredInterfaceModel: virtio preferredRng: {} + preferredArchitecture: arm64 requirements: + architecture: arm64 cpu: guest: 1 memory: @@ -740,13 +942,19 @@ metadata: annotations: iconClass: icon-rhel openshift.io/display-name: Red Hat Enterprise Linux 9 Desktop (amd64) - openshift.io/documentation-url: https://github.com/kubevirt/common-instancetypes + openshift.io/documentation-url: | + "https://github.com/kubevirt/common-instancetypes" openshift.io/provider-display-name: KubeVirt - openshift.io/support-url: https://github.com/kubevirt/common-instancetypes/issues + openshift.io/support-url: | + "https://github.com/kubevirt/common-instancetypes/issues" tags: hidden,kubevirt,linux,rhel labels: instancetype.kubevirt.io/arch: amd64 instancetype.kubevirt.io/os-type: linux + instancetype.kubevirt.io/preferred-architecture: amd64 + instancetype.kubevirt.io/required-architecture: amd64 + instancetype.kubevirt.io/required-cpu: "1" + instancetype.kubevirt.io/required-memory: 1.5Gi instancetype.kubevirt.io/vendor: kubevirt.io name: rhel.9.desktop spec: @@ -765,7 +973,9 @@ spec: firmware: preferredEfi: secureBoot: true + preferredArchitecture: amd64 requirements: + architecture: amd64 cpu: guest: 1 memory: @@ -777,13 +987,19 @@ metadata: annotations: iconClass: icon-rhel openshift.io/display-name: Red Hat Enterprise Linux 9 DPDK (amd64) - openshift.io/documentation-url: https://github.com/kubevirt/common-instancetypes + openshift.io/documentation-url: | + "https://github.com/kubevirt/common-instancetypes" openshift.io/provider-display-name: KubeVirt - openshift.io/support-url: https://github.com/kubevirt/common-instancetypes/issues + openshift.io/support-url: | + "https://github.com/kubevirt/common-instancetypes/issues" tags: hidden,kubevirt,linux,rhel,dpdk labels: instancetype.kubevirt.io/arch: amd64 instancetype.kubevirt.io/os-type: linux + instancetype.kubevirt.io/preferred-architecture: amd64 + instancetype.kubevirt.io/required-architecture: amd64 + instancetype.kubevirt.io/required-cpu: "8" + instancetype.kubevirt.io/required-memory: 1.5Gi instancetype.kubevirt.io/vendor: kubevirt.io name: rhel.9.dpdk spec: @@ -805,9 +1021,11 @@ spec: firmware: preferredEfi: secureBoot: true + preferredArchitecture: amd64 requirements: + architecture: amd64 cpu: - guest: 2 + guest: 8 memory: guest: 1.5Gi --- @@ -817,13 +1035,19 @@ metadata: annotations: iconClass: icon-rhel openshift.io/display-name: Red Hat Enterprise Linux 9 Realtime (amd64) - openshift.io/documentation-url: https://github.com/kubevirt/common-instancetypes + openshift.io/documentation-url: | + "https://github.com/kubevirt/common-instancetypes" openshift.io/provider-display-name: KubeVirt - openshift.io/support-url: https://github.com/kubevirt/common-instancetypes/issues + openshift.io/support-url: | + "https://github.com/kubevirt/common-instancetypes/issues" tags: hidden,kubevirt,linux,rhel,realtime labels: instancetype.kubevirt.io/arch: amd64 instancetype.kubevirt.io/os-type: linux + instancetype.kubevirt.io/preferred-architecture: amd64 + instancetype.kubevirt.io/required-architecture: amd64 + instancetype.kubevirt.io/required-cpu: "4" + instancetype.kubevirt.io/required-memory: 4Gi instancetype.kubevirt.io/vendor: kubevirt.io name: rhel.9.realtime spec: @@ -847,7 +1071,46 @@ spec: firmware: preferredEfi: secureBoot: true + preferredArchitecture: amd64 requirements: + architecture: amd64 + cpu: + guest: 4 + memory: + guest: 4Gi +--- +apiVersion: instancetype.kubevirt.io/v1beta1 +kind: VirtualMachineClusterPreference +metadata: + annotations: + iconClass: icon-rhel + openshift.io/display-name: Red Hat Enterprise Linux 9 (s390x) + openshift.io/documentation-url: | + "https://github.com/kubevirt/common-instancetypes" + openshift.io/provider-display-name: KubeVirt + openshift.io/support-url: | + "https://github.com/kubevirt/common-instancetypes/issues" + tags: hidden,kubevirt,linux,rhel + labels: + instancetype.kubevirt.io/arch: s390x + instancetype.kubevirt.io/os-type: linux + instancetype.kubevirt.io/preferred-architecture: s390x + instancetype.kubevirt.io/required-architecture: s390x + instancetype.kubevirt.io/required-cpu: "1" + instancetype.kubevirt.io/required-memory: 1.5Gi + instancetype.kubevirt.io/vendor: kubevirt.io + name: rhel.9.s390x +spec: + annotations: + vm.kubevirt.io/os: linux + devices: + preferredDiskBus: virtio + preferredDiskDedicatedIoThread: true + preferredInterfaceModel: virtio + preferredRng: {} + preferredArchitecture: s390x + requirements: + architecture: s390x cpu: guest: 1 memory: @@ -859,12 +1122,16 @@ metadata: annotations: iconClass: icon-sles openshift.io/display-name: SUSE Linux Enterprise Server - openshift.io/documentation-url: https://github.com/kubevirt/common-instancetypes + openshift.io/documentation-url: | + "https://github.com/kubevirt/common-instancetypes" openshift.io/provider-display-name: KubeVirt - openshift.io/support-url: https://github.com/kubevirt/common-instancetypes/issues + openshift.io/support-url: | + "https://github.com/kubevirt/common-instancetypes/issues" tags: hidden,kubevirt,sles labels: instancetype.kubevirt.io/os-type: linux + instancetype.kubevirt.io/required-cpu: "1" + instancetype.kubevirt.io/required-memory: 2Gi instancetype.kubevirt.io/vendor: kubevirt.io name: sles spec: @@ -886,12 +1153,16 @@ metadata: annotations: iconClass: icon-ubuntu openshift.io/display-name: Ubuntu - openshift.io/documentation-url: https://github.com/kubevirt/common-instancetypes + openshift.io/documentation-url: | + "https://github.com/kubevirt/common-instancetypes" openshift.io/provider-display-name: KubeVirt - openshift.io/support-url: https://github.com/kubevirt/common-instancetypes/issues + openshift.io/support-url: | + "https://github.com/kubevirt/common-instancetypes/issues" tags: hidden,kubevirt,ubuntu labels: instancetype.kubevirt.io/os-type: linux + instancetype.kubevirt.io/required-cpu: "1" + instancetype.kubevirt.io/required-memory: 2Gi instancetype.kubevirt.io/vendor: kubevirt.io name: ubuntu spec: @@ -913,12 +1184,16 @@ metadata: annotations: iconClass: icon-windows openshift.io/display-name: Microsoft Windows 10 - openshift.io/documentation-url: https://github.com/kubevirt/common-instancetypes + openshift.io/documentation-url: | + "https://github.com/kubevirt/common-instancetypes" openshift.io/provider-display-name: KubeVirt - openshift.io/support-url: https://github.com/kubevirt/common-instancetypes/issues + openshift.io/support-url: | + "https://github.com/kubevirt/common-instancetypes/issues" tags: hidden,kubevirt,windows labels: instancetype.kubevirt.io/os-type: windows + instancetype.kubevirt.io/required-cpu: "1" + instancetype.kubevirt.io/required-memory: 2Gi instancetype.kubevirt.io/vendor: kubevirt.io name: windows.10 spec: @@ -976,12 +1251,16 @@ metadata: annotations: iconClass: icon-windows openshift.io/display-name: Microsoft Windows 10 (virtio) - openshift.io/documentation-url: https://github.com/kubevirt/common-instancetypes + openshift.io/documentation-url: | + "https://github.com/kubevirt/common-instancetypes" openshift.io/provider-display-name: KubeVirt - openshift.io/support-url: https://github.com/kubevirt/common-instancetypes/issues + openshift.io/support-url: | + "https://github.com/kubevirt/common-instancetypes/issues" tags: hidden,kubevirt,windows labels: instancetype.kubevirt.io/os-type: windows + instancetype.kubevirt.io/required-cpu: "1" + instancetype.kubevirt.io/required-memory: 2Gi instancetype.kubevirt.io/vendor: kubevirt.io name: windows.10.virtio spec: @@ -1041,12 +1320,16 @@ metadata: annotations: iconClass: icon-windows openshift.io/display-name: Microsoft Windows 11 - openshift.io/documentation-url: https://github.com/kubevirt/common-instancetypes + openshift.io/documentation-url: | + "https://github.com/kubevirt/common-instancetypes" openshift.io/provider-display-name: KubeVirt - openshift.io/support-url: https://github.com/kubevirt/common-instancetypes/issues + openshift.io/support-url: | + "https://github.com/kubevirt/common-instancetypes/issues" tags: hidden,kubevirt,windows labels: instancetype.kubevirt.io/os-type: windows + instancetype.kubevirt.io/required-cpu: "2" + instancetype.kubevirt.io/required-memory: 4Gi instancetype.kubevirt.io/vendor: kubevirt.io name: windows.11 spec: @@ -1070,6 +1353,7 @@ spec: preferredDiskBus: sata preferredInterfaceModel: e1000e preferredTPM: + persistent: true features: preferredAcpi: {} preferredApic: {} @@ -1091,6 +1375,7 @@ spec: preferredSmm: {} firmware: preferredEfi: + persistent: true secureBoot: true preferredTerminationGracePeriodSeconds: 3600 requirements: @@ -1105,12 +1390,16 @@ metadata: annotations: iconClass: icon-windows openshift.io/display-name: Microsoft Windows 11 (virtio) - openshift.io/documentation-url: https://github.com/kubevirt/common-instancetypes + openshift.io/documentation-url: | + "https://github.com/kubevirt/common-instancetypes" openshift.io/provider-display-name: KubeVirt - openshift.io/support-url: https://github.com/kubevirt/common-instancetypes/issues + openshift.io/support-url: | + "https://github.com/kubevirt/common-instancetypes/issues" tags: hidden,kubevirt,windows labels: instancetype.kubevirt.io/os-type: windows + instancetype.kubevirt.io/required-cpu: "2" + instancetype.kubevirt.io/required-memory: 4Gi instancetype.kubevirt.io/vendor: kubevirt.io name: windows.11.virtio spec: @@ -1136,6 +1425,7 @@ spec: preferredInputType: tablet preferredInterfaceModel: virtio preferredTPM: + persistent: true features: preferredAcpi: {} preferredApic: {} @@ -1157,6 +1447,7 @@ spec: preferredSmm: {} firmware: preferredEfi: + persistent: true secureBoot: true preferredTerminationGracePeriodSeconds: 3600 requirements: @@ -1170,13 +1461,145 @@ kind: VirtualMachineClusterPreference metadata: annotations: iconClass: icon-windows - openshift.io/display-name: Microsoft Windows Server 2016 - openshift.io/documentation-url: https://github.com/kubevirt/common-instancetypes + openshift.io/display-name: Microsoft Windows Server 2012/2012 R2 + openshift.io/documentation-url: | + "https://github.com/kubevirt/common-instancetypes" openshift.io/provider-display-name: KubeVirt - openshift.io/support-url: https://github.com/kubevirt/common-instancetypes/issues + openshift.io/support-url: | + "https://github.com/kubevirt/common-instancetypes/issues" tags: hidden,kubevirt,windows labels: instancetype.kubevirt.io/os-type: windows + instancetype.kubevirt.io/required-cpu: "1" + instancetype.kubevirt.io/required-memory: 512Mi + instancetype.kubevirt.io/vendor: kubevirt.io + name: windows.2k12 +spec: + annotations: + vm.kubevirt.io/os: windows + clock: + preferredClockOffset: + utc: {} + preferredTimer: + hpet: + present: false + hyperv: {} + pit: + tickPolicy: delay + rtc: + tickPolicy: catchup + cpu: + preferredCPUTopology: sockets + devices: + preferredAutoattachInputDevice: true + preferredDiskBus: sata + preferredInterfaceModel: e1000e + features: + preferredAcpi: {} + preferredApic: {} + preferredHyperv: + frequencies: {} + ipi: {} + reenlightenment: {} + relaxed: {} + reset: {} + runtime: {} + spinlocks: + spinlocks: 8191 + synic: {} + synictimer: + direct: {} + tlbflush: {} + vapic: {} + vpindex: {} + preferredTerminationGracePeriodSeconds: 3600 + requirements: + cpu: + guest: 1 + memory: + guest: 512Mi +--- +apiVersion: instancetype.kubevirt.io/v1beta1 +kind: VirtualMachineClusterPreference +metadata: + annotations: + iconClass: icon-windows + openshift.io/display-name: Microsoft Windows Server 2012/2012 R2 (virtio) + openshift.io/documentation-url: | + "https://github.com/kubevirt/common-instancetypes" + openshift.io/provider-display-name: KubeVirt + openshift.io/support-url: | + "https://github.com/kubevirt/common-instancetypes/issues" + tags: hidden,kubevirt,windows + labels: + instancetype.kubevirt.io/os-type: windows + instancetype.kubevirt.io/required-cpu: "1" + instancetype.kubevirt.io/required-memory: 512Mi + instancetype.kubevirt.io/vendor: kubevirt.io + name: windows.2k12.virtio +spec: + annotations: + vm.kubevirt.io/os: windows + clock: + preferredClockOffset: + utc: {} + preferredTimer: + hpet: + present: false + hyperv: {} + pit: + tickPolicy: delay + rtc: + tickPolicy: catchup + cpu: + preferredCPUTopology: sockets + devices: + preferredAutoattachInputDevice: true + preferredDiskBus: virtio + preferredInputBus: virtio + preferredInputType: tablet + preferredInterfaceModel: virtio + features: + preferredAcpi: {} + preferredApic: {} + preferredHyperv: + frequencies: {} + ipi: {} + reenlightenment: {} + relaxed: {} + reset: {} + runtime: {} + spinlocks: + spinlocks: 8191 + synic: {} + synictimer: + direct: {} + tlbflush: {} + vapic: {} + vpindex: {} + preferredTerminationGracePeriodSeconds: 3600 + requirements: + cpu: + guest: 1 + memory: + guest: 512Mi +--- +apiVersion: instancetype.kubevirt.io/v1beta1 +kind: VirtualMachineClusterPreference +metadata: + annotations: + iconClass: icon-windows + openshift.io/display-name: Microsoft Windows Server 2016 + openshift.io/documentation-url: | + "https://github.com/kubevirt/common-instancetypes" + openshift.io/provider-display-name: KubeVirt + openshift.io/support-url: | + "https://github.com/kubevirt/common-instancetypes/issues" + tags: hidden,kubevirt,windows + labels: + instancetype.kubevirt.io/os-type: windows + instancetype.kubevirt.io/required-cpu: "1" + instancetype.kubevirt.io/required-memory: 2Gi instancetype.kubevirt.io/vendor: kubevirt.io name: windows.2k16 spec: @@ -1234,12 +1657,16 @@ metadata: annotations: iconClass: icon-windows openshift.io/display-name: Microsoft Windows Server 2016 (virtio) - openshift.io/documentation-url: https://github.com/kubevirt/common-instancetypes + openshift.io/documentation-url: | + "https://github.com/kubevirt/common-instancetypes" openshift.io/provider-display-name: KubeVirt - openshift.io/support-url: https://github.com/kubevirt/common-instancetypes/issues + openshift.io/support-url: | + "https://github.com/kubevirt/common-instancetypes/issues" tags: hidden,kubevirt,windows labels: instancetype.kubevirt.io/os-type: windows + instancetype.kubevirt.io/required-cpu: "1" + instancetype.kubevirt.io/required-memory: 2Gi instancetype.kubevirt.io/vendor: kubevirt.io name: windows.2k16.virtio spec: @@ -1299,12 +1726,16 @@ metadata: annotations: iconClass: icon-windows openshift.io/display-name: Microsoft Windows Server 2019 - openshift.io/documentation-url: https://github.com/kubevirt/common-instancetypes + openshift.io/documentation-url: | + "https://github.com/kubevirt/common-instancetypes" openshift.io/provider-display-name: KubeVirt - openshift.io/support-url: https://github.com/kubevirt/common-instancetypes/issues + openshift.io/support-url: | + "https://github.com/kubevirt/common-instancetypes/issues" tags: hidden,kubevirt,windows labels: instancetype.kubevirt.io/os-type: windows + instancetype.kubevirt.io/required-cpu: "1" + instancetype.kubevirt.io/required-memory: 2Gi instancetype.kubevirt.io/vendor: kubevirt.io name: windows.2k19 spec: @@ -1362,12 +1793,16 @@ metadata: annotations: iconClass: icon-windows openshift.io/display-name: Microsoft Windows Server 2019 (virtio) - openshift.io/documentation-url: https://github.com/kubevirt/common-instancetypes + openshift.io/documentation-url: | + "https://github.com/kubevirt/common-instancetypes" openshift.io/provider-display-name: KubeVirt - openshift.io/support-url: https://github.com/kubevirt/common-instancetypes/issues + openshift.io/support-url: | + "https://github.com/kubevirt/common-instancetypes/issues" tags: hidden,kubevirt,windows labels: instancetype.kubevirt.io/os-type: windows + instancetype.kubevirt.io/required-cpu: "1" + instancetype.kubevirt.io/required-memory: 2Gi instancetype.kubevirt.io/vendor: kubevirt.io name: windows.2k19.virtio spec: @@ -1427,12 +1862,16 @@ metadata: annotations: iconClass: icon-windows openshift.io/display-name: Microsoft Windows Server 2022 - openshift.io/documentation-url: https://github.com/kubevirt/common-instancetypes + openshift.io/documentation-url: | + "https://github.com/kubevirt/common-instancetypes" openshift.io/provider-display-name: KubeVirt - openshift.io/support-url: https://github.com/kubevirt/common-instancetypes/issues + openshift.io/support-url: | + "https://github.com/kubevirt/common-instancetypes/issues" tags: hidden,kubevirt,windows labels: instancetype.kubevirt.io/os-type: windows + instancetype.kubevirt.io/required-cpu: "1" + instancetype.kubevirt.io/required-memory: 2Gi instancetype.kubevirt.io/vendor: kubevirt.io name: windows.2k22 spec: @@ -1456,6 +1895,7 @@ spec: preferredDiskBus: sata preferredInterfaceModel: e1000e preferredTPM: + persistent: true features: preferredAcpi: {} preferredApic: {} @@ -1477,6 +1917,7 @@ spec: preferredSmm: {} firmware: preferredEfi: + persistent: true secureBoot: true preferredTerminationGracePeriodSeconds: 3600 requirements: @@ -1491,12 +1932,16 @@ metadata: annotations: iconClass: icon-windows openshift.io/display-name: Microsoft Windows Server 2022 (virtio) - openshift.io/documentation-url: https://github.com/kubevirt/common-instancetypes + openshift.io/documentation-url: | + "https://github.com/kubevirt/common-instancetypes" openshift.io/provider-display-name: KubeVirt - openshift.io/support-url: https://github.com/kubevirt/common-instancetypes/issues + openshift.io/support-url: | + "https://github.com/kubevirt/common-instancetypes/issues" tags: hidden,kubevirt,windows labels: instancetype.kubevirt.io/os-type: windows + instancetype.kubevirt.io/required-cpu: "1" + instancetype.kubevirt.io/required-memory: 2Gi instancetype.kubevirt.io/vendor: kubevirt.io name: windows.2k22.virtio spec: @@ -1522,6 +1967,7 @@ spec: preferredInputType: tablet preferredInterfaceModel: virtio preferredTPM: + persistent: true features: preferredAcpi: {} preferredApic: {} @@ -1543,6 +1989,7 @@ spec: preferredSmm: {} firmware: preferredEfi: + persistent: true secureBoot: true preferredTerminationGracePeriodSeconds: 3600 requirements: @@ -1557,12 +2004,16 @@ metadata: annotations: iconClass: icon-windows openshift.io/display-name: Microsoft Windows Server 2025 - openshift.io/documentation-url: https://github.com/kubevirt/common-instancetypes + openshift.io/documentation-url: | + "https://github.com/kubevirt/common-instancetypes" openshift.io/provider-display-name: KubeVirt - openshift.io/support-url: https://github.com/kubevirt/common-instancetypes/issues + openshift.io/support-url: | + "https://github.com/kubevirt/common-instancetypes/issues" tags: hidden,kubevirt,windows labels: instancetype.kubevirt.io/os-type: windows + instancetype.kubevirt.io/required-cpu: "1" + instancetype.kubevirt.io/required-memory: 2Gi instancetype.kubevirt.io/vendor: kubevirt.io name: windows.2k25 spec: @@ -1586,6 +2037,7 @@ spec: preferredDiskBus: sata preferredInterfaceModel: e1000e preferredTPM: + persistent: true features: preferredAcpi: {} preferredApic: {} @@ -1607,6 +2059,7 @@ spec: preferredSmm: {} firmware: preferredEfi: + persistent: true secureBoot: true preferredTerminationGracePeriodSeconds: 3600 requirements: @@ -1621,12 +2074,16 @@ metadata: annotations: iconClass: icon-windows openshift.io/display-name: Microsoft Windows Server 2025 (virtio) - openshift.io/documentation-url: https://github.com/kubevirt/common-instancetypes + openshift.io/documentation-url: | + "https://github.com/kubevirt/common-instancetypes" openshift.io/provider-display-name: KubeVirt - openshift.io/support-url: https://github.com/kubevirt/common-instancetypes/issues + openshift.io/support-url: | + "https://github.com/kubevirt/common-instancetypes/issues" tags: hidden,kubevirt,windows labels: instancetype.kubevirt.io/os-type: windows + instancetype.kubevirt.io/required-cpu: "1" + instancetype.kubevirt.io/required-memory: 2Gi instancetype.kubevirt.io/vendor: kubevirt.io name: windows.2k25.virtio spec: @@ -1652,6 +2109,7 @@ spec: preferredInputType: tablet preferredInterfaceModel: virtio preferredTPM: + persistent: true features: preferredAcpi: {} preferredApic: {} @@ -1673,6 +2131,7 @@ spec: preferredSmm: {} firmware: preferredEfi: + persistent: true secureBoot: true preferredTerminationGracePeriodSeconds: 3600 requirements: @@ -1680,3 +2139,387 @@ spec: guest: 1 memory: guest: 2Gi +--- +apiVersion: instancetype.kubevirt.io/v1beta1 +kind: VirtualMachineClusterPreference +metadata: + annotations: + iconClass: icon-windows + openshift.io/display-name: Microsoft Windows Server 2003 + openshift.io/documentation-url: | + "https://github.com/kubevirt/common-instancetypes" + openshift.io/provider-display-name: KubeVirt + openshift.io/support-url: | + "https://github.com/kubevirt/common-instancetypes/issues" + tags: hidden,kubevirt,windows + labels: + instancetype.kubevirt.io/os-type: windows + instancetype.kubevirt.io/required-cpu: "1" + instancetype.kubevirt.io/required-memory: 256Mi + instancetype.kubevirt.io/vendor: kubevirt.io + name: windows.2k3 +spec: + annotations: + kubevirt.io/disablePCIHole64: "true" + vm.kubevirt.io/os: windows + clock: + preferredClockOffset: + utc: {} + preferredTimer: + hpet: + present: false + hyperv: {} + pit: + tickPolicy: delay + rtc: + tickPolicy: catchup + cpu: + preferredCPUTopology: sockets + devices: + preferredAutoattachInputDevice: true + preferredDiskBus: sata + preferredInterfaceModel: rtl8139 + features: + preferredAcpi: {} + preferredApic: {} + preferredHyperv: + frequencies: {} + ipi: {} + reenlightenment: {} + relaxed: {} + reset: {} + runtime: {} + spinlocks: + spinlocks: 8191 + synic: {} + synictimer: + direct: {} + tlbflush: {} + vapic: {} + vpindex: {} + preferredTerminationGracePeriodSeconds: 3600 + requirements: + cpu: + guest: 1 + memory: + guest: 256Mi +--- +apiVersion: instancetype.kubevirt.io/v1beta1 +kind: VirtualMachineClusterPreference +metadata: + annotations: + iconClass: icon-windows + openshift.io/display-name: Microsoft Windows Server 2008/2008 R2 + openshift.io/documentation-url: | + "https://github.com/kubevirt/common-instancetypes" + openshift.io/provider-display-name: KubeVirt + openshift.io/support-url: | + "https://github.com/kubevirt/common-instancetypes/issues" + tags: hidden,kubevirt,windows + labels: + instancetype.kubevirt.io/os-type: windows + instancetype.kubevirt.io/required-cpu: "1" + instancetype.kubevirt.io/required-memory: 512Mi + instancetype.kubevirt.io/vendor: kubevirt.io + name: windows.2k8 +spec: + annotations: + vm.kubevirt.io/os: windows + clock: + preferredClockOffset: + utc: {} + preferredTimer: + hpet: + present: false + hyperv: {} + pit: + tickPolicy: delay + rtc: + tickPolicy: catchup + cpu: + preferredCPUTopology: sockets + devices: + preferredAutoattachInputDevice: true + preferredDiskBus: sata + preferredInterfaceModel: e1000 + features: + preferredAcpi: {} + preferredApic: {} + preferredHyperv: + frequencies: {} + ipi: {} + reenlightenment: {} + relaxed: {} + reset: {} + runtime: {} + spinlocks: + spinlocks: 8191 + synic: {} + synictimer: + direct: {} + tlbflush: {} + vapic: {} + vpindex: {} + preferredTerminationGracePeriodSeconds: 3600 + requirements: + cpu: + guest: 1 + memory: + guest: 512Mi +--- +apiVersion: instancetype.kubevirt.io/v1beta1 +kind: VirtualMachineClusterPreference +metadata: + annotations: + iconClass: icon-windows + openshift.io/display-name: Microsoft Windows Server 2008/2008 R2 (virtio) + openshift.io/documentation-url: | + "https://github.com/kubevirt/common-instancetypes" + openshift.io/provider-display-name: KubeVirt + openshift.io/support-url: | + "https://github.com/kubevirt/common-instancetypes/issues" + tags: hidden,kubevirt,windows + labels: + instancetype.kubevirt.io/os-type: windows + instancetype.kubevirt.io/required-cpu: "1" + instancetype.kubevirt.io/required-memory: 512Mi + instancetype.kubevirt.io/vendor: kubevirt.io + name: windows.2k8.virtio +spec: + annotations: + vm.kubevirt.io/os: windows + clock: + preferredClockOffset: + utc: {} + preferredTimer: + hpet: + present: false + hyperv: {} + pit: + tickPolicy: delay + rtc: + tickPolicy: catchup + cpu: + preferredCPUTopology: sockets + devices: + preferredAutoattachInputDevice: true + preferredDiskBus: virtio + preferredInputBus: virtio + preferredInputType: tablet + preferredInterfaceModel: virtio + features: + preferredAcpi: {} + preferredApic: {} + preferredHyperv: + frequencies: {} + ipi: {} + reenlightenment: {} + relaxed: {} + reset: {} + runtime: {} + spinlocks: + spinlocks: 8191 + synic: {} + synictimer: + direct: {} + tlbflush: {} + vapic: {} + vpindex: {} + preferredTerminationGracePeriodSeconds: 3600 + requirements: + cpu: + guest: 1 + memory: + guest: 512Mi +--- +apiVersion: instancetype.kubevirt.io/v1beta1 +kind: VirtualMachineClusterPreference +metadata: + annotations: + iconClass: icon-windows + openshift.io/display-name: Microsoft Windows 7 + openshift.io/documentation-url: | + "https://github.com/kubevirt/common-instancetypes" + openshift.io/provider-display-name: KubeVirt + openshift.io/support-url: | + "https://github.com/kubevirt/common-instancetypes/issues" + tags: hidden,kubevirt,windows + labels: + instancetype.kubevirt.io/os-type: windows + instancetype.kubevirt.io/required-cpu: "1" + instancetype.kubevirt.io/required-memory: 2Gi + instancetype.kubevirt.io/vendor: kubevirt.io + name: windows.7 +spec: + annotations: + vm.kubevirt.io/os: windows + clock: + preferredClockOffset: + utc: {} + preferredTimer: + hpet: + present: false + hyperv: {} + pit: + tickPolicy: delay + rtc: + tickPolicy: catchup + cpu: + preferredCPUTopology: sockets + devices: + preferredAutoattachInputDevice: true + preferredDiskBus: sata + preferredInterfaceModel: e1000e + features: + preferredAcpi: {} + preferredApic: {} + preferredHyperv: + frequencies: {} + ipi: {} + reenlightenment: {} + relaxed: {} + reset: {} + runtime: {} + spinlocks: + spinlocks: 8191 + synic: {} + synictimer: + direct: {} + tlbflush: {} + vapic: {} + vpindex: {} + preferredTerminationGracePeriodSeconds: 3600 + requirements: + cpu: + guest: 1 + memory: + guest: 2Gi +--- +apiVersion: instancetype.kubevirt.io/v1beta1 +kind: VirtualMachineClusterPreference +metadata: + annotations: + iconClass: icon-windows + openshift.io/display-name: Microsoft Windows 7 (virtio) + openshift.io/documentation-url: | + "https://github.com/kubevirt/common-instancetypes" + openshift.io/provider-display-name: KubeVirt + openshift.io/support-url: | + "https://github.com/kubevirt/common-instancetypes/issues" + tags: hidden,kubevirt,windows + labels: + instancetype.kubevirt.io/os-type: windows + instancetype.kubevirt.io/required-cpu: "1" + instancetype.kubevirt.io/required-memory: 2Gi + instancetype.kubevirt.io/vendor: kubevirt.io + name: windows.7.virtio +spec: + annotations: + vm.kubevirt.io/os: windows + clock: + preferredClockOffset: + utc: {} + preferredTimer: + hpet: + present: false + hyperv: {} + pit: + tickPolicy: delay + rtc: + tickPolicy: catchup + cpu: + preferredCPUTopology: sockets + devices: + preferredAutoattachInputDevice: true + preferredDiskBus: virtio + preferredInputBus: virtio + preferredInputType: tablet + preferredInterfaceModel: virtio + features: + preferredAcpi: {} + preferredApic: {} + preferredHyperv: + frequencies: {} + ipi: {} + reenlightenment: {} + relaxed: {} + reset: {} + runtime: {} + spinlocks: + spinlocks: 8191 + synic: {} + synictimer: + direct: {} + tlbflush: {} + vapic: {} + vpindex: {} + preferredTerminationGracePeriodSeconds: 3600 + requirements: + cpu: + guest: 1 + memory: + guest: 2Gi +--- +apiVersion: instancetype.kubevirt.io/v1beta1 +kind: VirtualMachineClusterPreference +metadata: + annotations: + iconClass: icon-windows + openshift.io/display-name: Microsoft Windows XP + openshift.io/documentation-url: | + "https://github.com/kubevirt/common-instancetypes" + openshift.io/provider-display-name: KubeVirt + openshift.io/support-url: | + "https://github.com/kubevirt/common-instancetypes/issues" + tags: hidden,kubevirt,windows + labels: + instancetype.kubevirt.io/os-type: windows + instancetype.kubevirt.io/required-cpu: "1" + instancetype.kubevirt.io/required-memory: 128Mi + instancetype.kubevirt.io/vendor: kubevirt.io + name: windows.xp +spec: + annotations: + kubevirt.io/disablePCIHole64: "true" + vm.kubevirt.io/os: windows + clock: + preferredClockOffset: + utc: {} + preferredTimer: + hpet: + present: false + hyperv: {} + pit: + tickPolicy: delay + rtc: + tickPolicy: catchup + cpu: + preferredCPUTopology: sockets + devices: + preferredAutoattachInputDevice: true + preferredDiskBus: sata + preferredInterfaceModel: e1000e + features: + preferredAcpi: {} + preferredApic: {} + preferredHyperv: + frequencies: {} + ipi: {} + reenlightenment: {} + relaxed: {} + reset: {} + runtime: {} + spinlocks: + spinlocks: 8191 + synic: {} + synictimer: + direct: {} + tlbflush: {} + vapic: {} + vpindex: {} + preferredTerminationGracePeriodSeconds: 3600 + requirements: + cpu: + guest: 1 + memory: + guest: 128Mi diff --git a/packages/system/vm-instance-rd/cozyrds/vm-instance.yaml b/packages/system/vm-instance-rd/cozyrds/vm-instance.yaml index e56bd9dd8..4dff321fb 100644 --- a/packages/system/vm-instance-rd/cozyrds/vm-instance.yaml +++ b/packages/system/vm-instance-rd/cozyrds/vm-instance.yaml @@ -8,7 +8,7 @@ spec: singular: vminstance plural: vminstances openAPISchema: |- - {"title":"Chart Values","type":"object","properties":{"external":{"description":"Enable external access from outside the cluster.","type":"boolean","default":false},"externalMethod":{"description":"Method to pass through traffic to the VM.","type":"string","default":"PortList","enum":["PortList","WholeIP"]},"externalPorts":{"description":"Ports to forward from outside the cluster.","type":"array","default":[22],"items":{"type":"integer"}},"externalAllowICMP":{"description":"Whether to accept ICMP traffic to the VM in PortList mode (preserves ping and PMTU discovery). No effect in WholeIP mode. Default true so ping behaves as users expect even when port filtering is in effect.","type":"boolean","default":true},"runStrategy":{"description":"Requested running state of the VirtualMachineInstance","type":"string","default":"Always","enum":["Always","Halted","Manual","RerunOnFailure","Once"]},"instanceType":{"description":"Virtual Machine instance type.","type":"string","default":"u1.medium"},"instanceProfile":{"description":"Virtual Machine preferences profile.","type":"string","default":"ubuntu","enum":["alpine","centos.7","centos.7.desktop","centos.stream10","centos.stream10.desktop","centos.stream8","centos.stream8.desktop","centos.stream8.dpdk","centos.stream9","centos.stream9.desktop","centos.stream9.dpdk","cirros","fedora","fedora.arm64","opensuse.leap","opensuse.tumbleweed","rhel.10","rhel.10.arm64","rhel.7","rhel.7.desktop","rhel.8","rhel.8.desktop","rhel.8.dpdk","rhel.9","rhel.9.arm64","rhel.9.desktop","rhel.9.dpdk","rhel.9.realtime","sles","ubuntu","windows.10","windows.10.virtio","windows.11","windows.11.virtio","windows.2k16","windows.2k16.virtio","windows.2k19","windows.2k19.virtio","windows.2k22","windows.2k22.virtio","windows.2k25","windows.2k25.virtio",""]},"disks":{"description":"List of disks to attach.","type":"array","default":[],"items":{"type":"object","required":["name"],"properties":{"bus":{"description":"Disk bus type (e.g. \"sata\").","type":"string"},"name":{"description":"Disk name.","type":"string"}}}},"networks":{"description":"Networks to attach the VM to.","type":"array","default":[],"items":{"type":"object","properties":{"name":{"description":"Network attachment name.","type":"string"}}}},"subnets":{"description":"Deprecated: use networks instead.","type":"array","default":[],"items":{"type":"object","properties":{"name":{"description":"Network attachment name.","type":"string"}}}},"gpus":{"description":"List of GPUs to attach (NVIDIA driver requires at least 4 GiB RAM).","type":"array","default":[],"items":{"type":"object","required":["name"],"properties":{"name":{"description":"The name of the GPU resource to attach.","type":"string"}}}},"cpuModel":{"description":"Model specifies the CPU model inside the VMI. List of available models https://github.com/libvirt/libvirt/tree/master/src/cpu_map","type":"string","default":""},"resources":{"description":"Resource configuration for the virtual machine.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"sockets":{"description":"Number of CPU sockets (vCPU topology).","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"sshKeys":{"description":"List of SSH public keys for authentication.","type":"array","default":[],"items":{"type":"string"}},"cloudInit":{"description":"Cloud-init user data.","type":"string","default":""},"cloudInitSeed":{"description":"Seed string to generate SMBIOS UUID for the VM.","type":"string","default":""}}} + {"title":"Chart Values","type":"object","properties":{"external":{"description":"Enable external access from outside the cluster.","type":"boolean","default":false},"externalMethod":{"description":"Method to pass through traffic to the VM.","type":"string","default":"PortList","enum":["PortList","WholeIP"]},"externalPorts":{"description":"Ports to forward from outside the cluster.","type":"array","default":[22],"items":{"type":"integer"}},"externalAllowICMP":{"description":"Whether to accept ICMP traffic to the VM in PortList mode (preserves ping and PMTU discovery). No effect in WholeIP mode. Default true so ping behaves as users expect even when port filtering is in effect.","type":"boolean","default":true},"runStrategy":{"description":"Requested running state of the VirtualMachineInstance","type":"string","default":"Always","enum":["Always","Halted","Manual","RerunOnFailure","Once"]},"instanceType":{"description":"Virtual Machine instance type.","type":"string","default":"u1.medium"},"instanceProfile":{"description":"Virtual Machine preferences profile.","type":"string","default":"ubuntu","enum":["alpine","centos.stream10","centos.stream10.desktop","centos.stream9","centos.stream9.desktop","centos.stream9.dpdk","cirros","debian","fedora","fedora.arm64","fedora.s390x","legacy","linux","linux.efi","linux.virtiotransitional","opensuse.leap","opensuse.tumbleweed","oraclelinux","rhel.10","rhel.10.arm64","rhel.10.s390x","rhel.7","rhel.7.desktop","rhel.8","rhel.8.desktop","rhel.8.dpdk","rhel.9","rhel.9.arm64","rhel.9.desktop","rhel.9.dpdk","rhel.9.realtime","rhel.9.s390x","sles","ubuntu","windows.10","windows.10.virtio","windows.11","windows.11.virtio","windows.2k12","windows.2k12.virtio","windows.2k16","windows.2k16.virtio","windows.2k19","windows.2k19.virtio","windows.2k22","windows.2k22.virtio","windows.2k25","windows.2k25.virtio","windows.2k3","windows.2k8","windows.2k8.virtio","windows.7","windows.7.virtio","windows.xp",""]},"disks":{"description":"List of disks to attach.","type":"array","default":[],"items":{"type":"object","required":["name"],"properties":{"bus":{"description":"Disk bus type (e.g. \"sata\").","type":"string"},"name":{"description":"Disk name.","type":"string"}}}},"networks":{"description":"Networks to attach the VM to.","type":"array","default":[],"items":{"type":"object","properties":{"name":{"description":"Network attachment name.","type":"string"}}}},"subnets":{"description":"Deprecated: use networks instead.","type":"array","default":[],"items":{"type":"object","properties":{"name":{"description":"Network attachment name.","type":"string"}}}},"gpus":{"description":"List of GPUs to attach (NVIDIA driver requires at least 4 GiB RAM).","type":"array","default":[],"items":{"type":"object","required":["name"],"properties":{"name":{"description":"The name of the GPU resource to attach.","type":"string"}}}},"cpuModel":{"description":"Model specifies the CPU model inside the VMI. List of available models https://github.com/libvirt/libvirt/tree/master/src/cpu_map","type":"string","default":""},"resources":{"description":"Resource configuration for the virtual machine.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"sockets":{"description":"Number of CPU sockets (vCPU topology).","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"sshKeys":{"description":"List of SSH public keys for authentication.","type":"array","default":[],"items":{"type":"string"}},"cloudInit":{"description":"Cloud-init user data.","type":"string","default":""},"cloudInitSeed":{"description":"Seed string to generate SMBIOS UUID for the VM.","type":"string","default":""}}} release: prefix: vm-instance- labels: From 5121c7b91bc11948d6699e390278d2617c29b7ba Mon Sep 17 00:00:00 2001 From: Myasnikov Daniil Date: Mon, 25 May 2026 10:33:21 +0500 Subject: [PATCH 04/28] fix(foundationdb): relocate misplaced fields from automationOptions to spec MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The chart nested `faultDomain`, `imageType`, `labels`, and `minimumUptimeSecondsForBounce` inside `automationOptions`, but the FoundationDBCluster CRD schema defines all four as direct children of `spec`. Flux v2.7 (helm-controller v1.4.3) used permissive client-side patch and silently dropped the unknown fields; v2.8 (helm-controller v1.5.0) does strict Server-Side Apply and rejects: failed to create typed patch object: .spec.automationOptions.: field not declared in schema This was a latent bug from day one — none of those fields ever actually configured anything. Moving them one level up applies the values to where the operator looks for them. Co-Authored-By: Claude Opus 4.7 (1M context) Signed-off-by: Myasnikov Daniil --- .../apps/foundationdb/templates/cluster.yaml | 42 ++++++++++++------- 1 file changed, 27 insertions(+), 15 deletions(-) diff --git a/packages/apps/foundationdb/templates/cluster.yaml b/packages/apps/foundationdb/templates/cluster.yaml index be804233e..af9ff822f 100644 --- a/packages/apps/foundationdb/templates/cluster.yaml +++ b/packages/apps/foundationdb/templates/cluster.yaml @@ -21,21 +21,33 @@ spec: automationOptions: replacements: enabled: {{ .Values.automaticReplacements }} - faultDomain: - key: {{ .Values.cluster.faultDomain.key }} - {{- if .Values.cluster.faultDomain.valueFrom }} - valueFrom: {{ .Values.cluster.faultDomain.valueFrom }} - {{- end }} - imageType: {{ .Values.imageType }} - labels: - filterOnOwnerReference: false - matchLabels: - foundationdb.org/fdb-cluster-name: {{ .Release.Name }} - processClassLabels: - - foundationdb.org/fdb-process-class - processGroupIDLabels: - - foundationdb.org/fdb-process-group-id - minimumUptimeSecondsForBounce: 60 + + # The FoundationDBCluster CRD schema places faultDomain, imageType, labels, + # and minimumUptimeSecondsForBounce as direct children of spec (siblings of + # automationOptions). The chart historically nested them under + # automationOptions; Flux v2.7's client-side patch silently dropped the + # unknown fields, so the misconfiguration had no runtime effect. Flux v2.8's + # Server-Side Apply enforces the CRD schema and rejects the apply with + # "field not declared in schema". Move all four fields to where the + # operator actually reads them. + faultDomain: + key: {{ .Values.cluster.faultDomain.key }} + {{- if .Values.cluster.faultDomain.valueFrom }} + valueFrom: {{ .Values.cluster.faultDomain.valueFrom }} + {{- end }} + + imageType: {{ .Values.imageType }} + + labels: + filterOnOwnerReference: false + matchLabels: + foundationdb.org/fdb-cluster-name: {{ .Release.Name }} + processClassLabels: + - foundationdb.org/fdb-process-class + processGroupIDLabels: + - foundationdb.org/fdb-process-group-id + + minimumUptimeSecondsForBounce: 60 processes: general: From 7cb7be8124b4f52d4bf0fd34aa27fe9c009fc23a Mon Sep 17 00:00:00 2001 From: Myasnikov Daniil Date: Thu, 14 May 2026 16:27:50 +0500 Subject: [PATCH 05/28] fix(kafka): place enableServiceLinks under template.pod, not a phantom .spec MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Same class of bug as the foundationdb misplaced-field fixes. The kafka chart had: entityOperator: template: pod: metadata: { labels: { ... } } spec: ← child of template, not of pod enableServiceLinks: false The Strimzi Kafka CRD's `entityOperator.template` has no `spec` key. `enableServiceLinks` is a direct field of `template.pod` (alongside metadata, affinity, tolerations, etc.). Flux v2.7's permissive client-side patch silently dropped the misplaced field; v2.8's strict Server-Side Apply rejects: failed to create typed patch object (Kind=Kafka): .spec.entityOperator.template.spec: field not declared in schema Move `enableServiceLinks` under `template.pod` where the operator actually reads it, and fix the inconsistent metadata.labels indentation (was 9/11 spaces instead of 10/12) while we're here. Assisted-By: Claude Signed-off-by: Myasnikov Daniil (cherry picked from commit 447f1dcbf1c93cd8d1bda4f95eeb6cb88ee5127f) --- packages/apps/kafka/templates/kafka.yaml | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/packages/apps/kafka/templates/kafka.yaml b/packages/apps/kafka/templates/kafka.yaml index e164d83c9..030129b72 100644 --- a/packages/apps/kafka/templates/kafka.yaml +++ b/packages/apps/kafka/templates/kafka.yaml @@ -84,9 +84,13 @@ spec: topicOperator: {} userOperator: {} template: + # `pod` accepts metadata + a flat set of pod-spec fields + # (enableServiceLinks, securityContext, affinity, …) directly. + # The previous file nested enableServiceLinks under a phantom + # `template.spec` key — Flux v2.7 dropped it silently, v2.8 SSA + # rejects it with "field not declared in schema". pod: metadata: - labels: - policy.cozystack.io/allow-to-apiserver: "true" - spec: + labels: + policy.cozystack.io/allow-to-apiserver: "true" enableServiceLinks: false From 7f94182a874a343406ee9f40696cd0041dd43f5e Mon Sep 17 00:00:00 2001 From: Myasnikov Daniil Date: Fri, 15 May 2026 17:17:18 +0500 Subject: [PATCH 06/28] fix(platform): drop deprecated upgrade.force from HelmReleases; fix kafka WorkloadMonitor replicas paths Flux v2.8 / helm-controller v1.5.0 embeds Helm v4, which renamed --force to --force-replace and rejects combining it with SSA's --force-conflicts. Existing HelmReleases with spec.upgrade.force: true fail every upgrade with "cannot use force conflicts and force replace together", looping upgrade -> rollback -> upgrade and blocking dependants. Observed on PR #2619 CI for tenant-root/{ingress-nginx-system,seaweedfs-db}, tenant-test/info, and others. Per Flux docs, upgrade.force has been a no-op since v2.8 anyway, so removing it is safe on green clusters and unblocks broken ones. Also fix packages/apps/kafka/templates/workloadmonitor.yaml: it referenced .Values.replicas (no such field; values.yaml has kafka.replicas and zookeeper.replicas). Flux v2.7 silently dropped the null; v2.8 SSA forwards it, and the WorkloadMonitor CRD rejects "spec.replicas: null" as not type:integer, which blocks every kafka-test install. Co-Authored-By: Claude Opus 4.7 Signed-off-by: Myasnikov Daniil (cherry picked from commit 7e286cf8e104a15d2d26b86a1888e3e045e5b015) --- packages/apps/bucket/templates/helmrelease.yaml | 1 - packages/apps/harbor/templates/harbor.yaml | 1 - packages/apps/kafka/templates/workloadmonitor.yaml | 4 ++-- .../kubernetes/templates/helmreleases/cert-manager-crds.yaml | 1 - .../apps/kubernetes/templates/helmreleases/cert-manager.yaml | 1 - packages/apps/kubernetes/templates/helmreleases/cilium.yaml | 1 - packages/apps/kubernetes/templates/helmreleases/coredns.yaml | 1 - packages/apps/kubernetes/templates/helmreleases/fluxcd.yaml | 1 - .../kubernetes/templates/helmreleases/gateway-api-crds.yaml | 1 - .../apps/kubernetes/templates/helmreleases/gpu-operator.yaml | 1 - packages/apps/kubernetes/templates/helmreleases/hami.yaml | 1 - .../apps/kubernetes/templates/helmreleases/ingress-nginx.yaml | 1 - .../kubernetes/templates/helmreleases/monitoring-agents.yaml | 1 - .../apps/kubernetes/templates/helmreleases/ouroboros.yaml | 1 - packages/apps/kubernetes/templates/helmreleases/velero.yaml | 1 - .../templates/helmreleases/vertical-pod-autoscaler.yaml | 1 - .../templates/helmreleases/victoria-metrics-operator.yaml | 1 - .../kubernetes/templates/helmreleases/volumesnapshot-crd.yaml | 1 - packages/apps/nats/templates/nats.yaml | 1 - packages/apps/openbao/templates/openbao.yaml | 1 - packages/apps/qdrant/templates/qdrant.yaml | 1 - packages/apps/tenant/templates/etcd.yaml | 1 - packages/apps/tenant/templates/info.yaml | 1 - packages/apps/tenant/templates/ingress.yaml | 1 - packages/apps/tenant/templates/monitoring.yaml | 1 - packages/apps/tenant/templates/seaweedfs.yaml | 1 - packages/extra/external-dns/templates/external-dns.yaml | 1 - packages/extra/ingress/templates/nginx-ingress.yaml | 1 - packages/extra/monitoring/templates/helmrelease.yaml | 1 - packages/extra/seaweedfs/templates/seaweedfs.yaml | 1 - 30 files changed, 2 insertions(+), 31 deletions(-) diff --git a/packages/apps/bucket/templates/helmrelease.yaml b/packages/apps/bucket/templates/helmrelease.yaml index d32905128..acaf8cc0b 100644 --- a/packages/apps/bucket/templates/helmrelease.yaml +++ b/packages/apps/bucket/templates/helmrelease.yaml @@ -15,7 +15,6 @@ spec: remediation: retries: -1 upgrade: - force: true remediation: retries: -1 valuesFrom: diff --git a/packages/apps/harbor/templates/harbor.yaml b/packages/apps/harbor/templates/harbor.yaml index d59c1c1b2..72bfa61a4 100644 --- a/packages/apps/harbor/templates/harbor.yaml +++ b/packages/apps/harbor/templates/harbor.yaml @@ -53,7 +53,6 @@ spec: remediation: retries: -1 upgrade: - force: true remediation: retries: -1 valuesFrom: diff --git a/packages/apps/kafka/templates/workloadmonitor.yaml b/packages/apps/kafka/templates/workloadmonitor.yaml index c31eb4254..ba58333ed 100644 --- a/packages/apps/kafka/templates/workloadmonitor.yaml +++ b/packages/apps/kafka/templates/workloadmonitor.yaml @@ -6,7 +6,7 @@ metadata: labels: workloads.cozystack.io/resource-preset: {{ .Values.kafka.resourcesPreset | quote }} spec: - replicas: {{ .Values.replicas }} + replicas: {{ .Values.kafka.replicas }} minReplicas: 1 kind: kafka type: kafka @@ -24,7 +24,7 @@ metadata: labels: workloads.cozystack.io/resource-preset: {{ .Values.zookeeper.resourcesPreset | quote }} spec: - replicas: {{ .Values.replicas }} + replicas: {{ .Values.zookeeper.replicas }} minReplicas: 1 kind: kafka type: zookeeper diff --git a/packages/apps/kubernetes/templates/helmreleases/cert-manager-crds.yaml b/packages/apps/kubernetes/templates/helmreleases/cert-manager-crds.yaml index fd9dac7eb..e6dfc6641 100644 --- a/packages/apps/kubernetes/templates/helmreleases/cert-manager-crds.yaml +++ b/packages/apps/kubernetes/templates/helmreleases/cert-manager-crds.yaml @@ -26,7 +26,6 @@ spec: remediation: retries: -1 upgrade: - force: true remediation: retries: -1 {{- if .Values.addons.certManager.valuesOverride }} diff --git a/packages/apps/kubernetes/templates/helmreleases/cert-manager.yaml b/packages/apps/kubernetes/templates/helmreleases/cert-manager.yaml index 700b666e3..060bf117e 100644 --- a/packages/apps/kubernetes/templates/helmreleases/cert-manager.yaml +++ b/packages/apps/kubernetes/templates/helmreleases/cert-manager.yaml @@ -36,7 +36,6 @@ spec: remediation: retries: -1 upgrade: - force: true remediation: retries: -1 values: diff --git a/packages/apps/kubernetes/templates/helmreleases/cilium.yaml b/packages/apps/kubernetes/templates/helmreleases/cilium.yaml index d8c90cbf4..db48ac73c 100644 --- a/packages/apps/kubernetes/templates/helmreleases/cilium.yaml +++ b/packages/apps/kubernetes/templates/helmreleases/cilium.yaml @@ -42,7 +42,6 @@ spec: remediation: retries: -1 upgrade: - force: true remediation: retries: -1 values: diff --git a/packages/apps/kubernetes/templates/helmreleases/coredns.yaml b/packages/apps/kubernetes/templates/helmreleases/coredns.yaml index 0711a51df..41b5e67c2 100644 --- a/packages/apps/kubernetes/templates/helmreleases/coredns.yaml +++ b/packages/apps/kubernetes/templates/helmreleases/coredns.yaml @@ -31,7 +31,6 @@ spec: remediation: retries: -1 upgrade: - force: true remediation: retries: -1 values: diff --git a/packages/apps/kubernetes/templates/helmreleases/fluxcd.yaml b/packages/apps/kubernetes/templates/helmreleases/fluxcd.yaml index 25fff01cf..6c9712c14 100644 --- a/packages/apps/kubernetes/templates/helmreleases/fluxcd.yaml +++ b/packages/apps/kubernetes/templates/helmreleases/fluxcd.yaml @@ -26,7 +26,6 @@ spec: remediation: retries: -1 upgrade: - force: true remediation: retries: -1 values: diff --git a/packages/apps/kubernetes/templates/helmreleases/gateway-api-crds.yaml b/packages/apps/kubernetes/templates/helmreleases/gateway-api-crds.yaml index b4172ed1a..f82923fe6 100644 --- a/packages/apps/kubernetes/templates/helmreleases/gateway-api-crds.yaml +++ b/packages/apps/kubernetes/templates/helmreleases/gateway-api-crds.yaml @@ -25,7 +25,6 @@ spec: remediation: retries: -1 upgrade: - force: true remediation: retries: -1 dependsOn: diff --git a/packages/apps/kubernetes/templates/helmreleases/gpu-operator.yaml b/packages/apps/kubernetes/templates/helmreleases/gpu-operator.yaml index 655dc868b..5368dc83e 100644 --- a/packages/apps/kubernetes/templates/helmreleases/gpu-operator.yaml +++ b/packages/apps/kubernetes/templates/helmreleases/gpu-operator.yaml @@ -34,7 +34,6 @@ spec: remediation: retries: -1 upgrade: - force: true remediation: retries: -1 {{- $defaults := fromYaml (include "cozystack.defaultGpuOperatorValues" .) }} diff --git a/packages/apps/kubernetes/templates/helmreleases/hami.yaml b/packages/apps/kubernetes/templates/helmreleases/hami.yaml index f1538c7c2..32c375a5d 100644 --- a/packages/apps/kubernetes/templates/helmreleases/hami.yaml +++ b/packages/apps/kubernetes/templates/helmreleases/hami.yaml @@ -29,7 +29,6 @@ spec: remediation: retries: -1 upgrade: - force: true remediation: retries: -1 {{- with .Values.addons.hami.valuesOverride }} diff --git a/packages/apps/kubernetes/templates/helmreleases/ingress-nginx.yaml b/packages/apps/kubernetes/templates/helmreleases/ingress-nginx.yaml index 6e2183d30..8432aea04 100644 --- a/packages/apps/kubernetes/templates/helmreleases/ingress-nginx.yaml +++ b/packages/apps/kubernetes/templates/helmreleases/ingress-nginx.yaml @@ -48,7 +48,6 @@ spec: remediation: retries: -1 upgrade: - force: true remediation: retries: -1 values: diff --git a/packages/apps/kubernetes/templates/helmreleases/monitoring-agents.yaml b/packages/apps/kubernetes/templates/helmreleases/monitoring-agents.yaml index a811f7ddd..695b1d4a9 100644 --- a/packages/apps/kubernetes/templates/helmreleases/monitoring-agents.yaml +++ b/packages/apps/kubernetes/templates/helmreleases/monitoring-agents.yaml @@ -28,7 +28,6 @@ spec: remediation: retries: -1 upgrade: - force: true remediation: retries: -1 dependsOn: diff --git a/packages/apps/kubernetes/templates/helmreleases/ouroboros.yaml b/packages/apps/kubernetes/templates/helmreleases/ouroboros.yaml index c61fea7ca..4d7b36d28 100644 --- a/packages/apps/kubernetes/templates/helmreleases/ouroboros.yaml +++ b/packages/apps/kubernetes/templates/helmreleases/ouroboros.yaml @@ -138,7 +138,6 @@ spec: remediation: retries: -1 upgrade: - force: true remediation: retries: -1 values: diff --git a/packages/apps/kubernetes/templates/helmreleases/velero.yaml b/packages/apps/kubernetes/templates/helmreleases/velero.yaml index 781b9c493..c5a32119e 100644 --- a/packages/apps/kubernetes/templates/helmreleases/velero.yaml +++ b/packages/apps/kubernetes/templates/helmreleases/velero.yaml @@ -26,7 +26,6 @@ spec: remediation: retries: -1 upgrade: - force: true remediation: retries: -1 {{- with .Values.addons.velero.valuesOverride }} diff --git a/packages/apps/kubernetes/templates/helmreleases/vertical-pod-autoscaler.yaml b/packages/apps/kubernetes/templates/helmreleases/vertical-pod-autoscaler.yaml index 74fb5a39b..10428b650 100644 --- a/packages/apps/kubernetes/templates/helmreleases/vertical-pod-autoscaler.yaml +++ b/packages/apps/kubernetes/templates/helmreleases/vertical-pod-autoscaler.yaml @@ -52,7 +52,6 @@ spec: remediation: retries: -1 upgrade: - force: true remediation: retries: -1 values: diff --git a/packages/apps/kubernetes/templates/helmreleases/victoria-metrics-operator.yaml b/packages/apps/kubernetes/templates/helmreleases/victoria-metrics-operator.yaml index 7302f8f5c..0bab0b420 100644 --- a/packages/apps/kubernetes/templates/helmreleases/victoria-metrics-operator.yaml +++ b/packages/apps/kubernetes/templates/helmreleases/victoria-metrics-operator.yaml @@ -26,7 +26,6 @@ spec: remediation: retries: -1 upgrade: - force: true remediation: retries: -1 dependsOn: diff --git a/packages/apps/kubernetes/templates/helmreleases/volumesnapshot-crd.yaml b/packages/apps/kubernetes/templates/helmreleases/volumesnapshot-crd.yaml index d50fd93cb..a70b6752e 100644 --- a/packages/apps/kubernetes/templates/helmreleases/volumesnapshot-crd.yaml +++ b/packages/apps/kubernetes/templates/helmreleases/volumesnapshot-crd.yaml @@ -26,7 +26,6 @@ spec: remediation: retries: -1 upgrade: - force: true remediation: retries: -1 dependsOn: diff --git a/packages/apps/nats/templates/nats.yaml b/packages/apps/nats/templates/nats.yaml index e5f5cf5dd..a254e53a6 100644 --- a/packages/apps/nats/templates/nats.yaml +++ b/packages/apps/nats/templates/nats.yaml @@ -46,7 +46,6 @@ spec: remediation: retries: -1 upgrade: - force: true remediation: retries: -1 valuesFrom: diff --git a/packages/apps/openbao/templates/openbao.yaml b/packages/apps/openbao/templates/openbao.yaml index daa6f9c4f..1b98fe2eb 100644 --- a/packages/apps/openbao/templates/openbao.yaml +++ b/packages/apps/openbao/templates/openbao.yaml @@ -15,7 +15,6 @@ spec: remediation: retries: -1 upgrade: - force: true remediation: retries: -1 valuesFrom: diff --git a/packages/apps/qdrant/templates/qdrant.yaml b/packages/apps/qdrant/templates/qdrant.yaml index 888bd05e3..689588248 100644 --- a/packages/apps/qdrant/templates/qdrant.yaml +++ b/packages/apps/qdrant/templates/qdrant.yaml @@ -15,7 +15,6 @@ spec: remediation: retries: -1 upgrade: - force: true remediation: retries: -1 valuesFrom: diff --git a/packages/apps/tenant/templates/etcd.yaml b/packages/apps/tenant/templates/etcd.yaml index 9a122da21..71e0b548d 100644 --- a/packages/apps/tenant/templates/etcd.yaml +++ b/packages/apps/tenant/templates/etcd.yaml @@ -23,7 +23,6 @@ spec: remediation: retries: -1 upgrade: - force: true remediation: retries: -1 valuesFrom: diff --git a/packages/apps/tenant/templates/info.yaml b/packages/apps/tenant/templates/info.yaml index 520028c10..b5a7550d1 100644 --- a/packages/apps/tenant/templates/info.yaml +++ b/packages/apps/tenant/templates/info.yaml @@ -22,7 +22,6 @@ spec: remediation: retries: -1 upgrade: - force: true remediation: retries: -1 valuesFrom: diff --git a/packages/apps/tenant/templates/ingress.yaml b/packages/apps/tenant/templates/ingress.yaml index 1899a4dae..229ee7c62 100644 --- a/packages/apps/tenant/templates/ingress.yaml +++ b/packages/apps/tenant/templates/ingress.yaml @@ -23,7 +23,6 @@ spec: remediation: retries: -1 upgrade: - force: true remediation: retries: -1 valuesFrom: diff --git a/packages/apps/tenant/templates/monitoring.yaml b/packages/apps/tenant/templates/monitoring.yaml index 4d77faa6f..29dbf95ab 100644 --- a/packages/apps/tenant/templates/monitoring.yaml +++ b/packages/apps/tenant/templates/monitoring.yaml @@ -23,7 +23,6 @@ spec: remediation: retries: -1 upgrade: - force: true remediation: retries: -1 valuesFrom: diff --git a/packages/apps/tenant/templates/seaweedfs.yaml b/packages/apps/tenant/templates/seaweedfs.yaml index e0002ec9a..c0a1cf0c0 100644 --- a/packages/apps/tenant/templates/seaweedfs.yaml +++ b/packages/apps/tenant/templates/seaweedfs.yaml @@ -23,7 +23,6 @@ spec: remediation: retries: -1 upgrade: - force: true remediation: retries: -1 valuesFrom: diff --git a/packages/extra/external-dns/templates/external-dns.yaml b/packages/extra/external-dns/templates/external-dns.yaml index f43de8833..29780d508 100644 --- a/packages/extra/external-dns/templates/external-dns.yaml +++ b/packages/extra/external-dns/templates/external-dns.yaml @@ -19,7 +19,6 @@ spec: remediation: retries: -1 upgrade: - force: true remediation: retries: -1 values: diff --git a/packages/extra/ingress/templates/nginx-ingress.yaml b/packages/extra/ingress/templates/nginx-ingress.yaml index ca50d2761..0a59ed50b 100644 --- a/packages/extra/ingress/templates/nginx-ingress.yaml +++ b/packages/extra/ingress/templates/nginx-ingress.yaml @@ -17,7 +17,6 @@ spec: remediation: retries: -1 upgrade: - force: true remediation: retries: -1 valuesFrom: diff --git a/packages/extra/monitoring/templates/helmrelease.yaml b/packages/extra/monitoring/templates/helmrelease.yaml index 0c3c2377d..af4e1dab6 100644 --- a/packages/extra/monitoring/templates/helmrelease.yaml +++ b/packages/extra/monitoring/templates/helmrelease.yaml @@ -15,7 +15,6 @@ spec: remediation: retries: -1 upgrade: - force: true remediation: retries: -1 valuesFrom: diff --git a/packages/extra/seaweedfs/templates/seaweedfs.yaml b/packages/extra/seaweedfs/templates/seaweedfs.yaml index 42db9b127..ba7953ee7 100644 --- a/packages/extra/seaweedfs/templates/seaweedfs.yaml +++ b/packages/extra/seaweedfs/templates/seaweedfs.yaml @@ -123,7 +123,6 @@ spec: remediation: retries: -1 upgrade: - force: true remediation: retries: -1 valuesFrom: From 2e3e7bdb39caef926a3f1beabe685c5661c20ab1 Mon Sep 17 00:00:00 2001 From: Myasnikov Daniil Date: Wed, 13 May 2026 14:48:50 +0500 Subject: [PATCH 07/28] fix(vm-instance): emit empty disk object so KubeVirt accepts disks without bus MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit When a disk entry has no bus set (the schema default), the previous template rendered `disk:` with no value — YAML parses that as `disk: null` and KubeVirt's virtualmachines-mutator webhook denies the request with: "spec.template.spec.domain.devices.disks.disk in body must be of type object: null". Restructure the disk loop so the disk/cdrom value is always a valid object: `disk: {}` when bus is empty, `disk: {bus: }` when set. Mirrors how `cloudinitdisk` already does it in the same template. Signed-off-by: Myasnikov Daniil (cherry picked from commit 0f3d2fa3a6efa94dbe1641cb22e7ab14ab2b5b9c) (cherry picked from commit e2c6b7b60b875a55fdfc4585182396cad82abb7e) --- packages/apps/vm-instance/templates/vm.yaml | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/packages/apps/vm-instance/templates/vm.yaml b/packages/apps/vm-instance/templates/vm.yaml index 55f278c1a..b6d20dfa6 100644 --- a/packages/apps/vm-instance/templates/vm.yaml +++ b/packages/apps/vm-instance/templates/vm.yaml @@ -67,14 +67,14 @@ spec: - name: disk-{{ $disk.name }} {{- $dv := lookup "cdi.kubevirt.io/v1beta1" "DataVolume" $.Release.Namespace (printf "vm-disk-%s" $disk.name) }} {{- if $dv }} - {{- if and (hasKey $dv.metadata.annotations "vm-disk.cozystack.io/optical") (eq (index $dv.metadata.annotations "vm-disk.cozystack.io/optical") "true") }} - cdrom: + {{- $isOptical := and (hasKey $dv.metadata.annotations "vm-disk.cozystack.io/optical") (eq (index $dv.metadata.annotations "vm-disk.cozystack.io/optical") "true") }} + {{- $deviceKey := ternary "cdrom" "disk" $isOptical }} + {{- if $disk.bus }} + {{ $deviceKey }}: + bus: {{ $disk.bus }} {{- else }} - disk: + {{ $deviceKey }}: {} {{- end }} - {{- with $disk.bus }} - bus: {{ . }} - {{- end }} bootOrder: {{ add $i 1 }} {{- else }} {{- fail (printf "Specified disk not exists in cluster: %s" .name) }} From 435b3e6275b96f81b2d4de5c2b6ba57c2edc88c0 Mon Sep 17 00:00:00 2001 From: Myasnikov Daniil Date: Tue, 12 May 2026 19:13:53 +0500 Subject: [PATCH 08/28] fix(vpa): break circular wait between parent install and nested vpa-for-vpa HR The packages/system/vertical-pod-autoscaler chart's vpa-for-vpa.yaml template emits an HR in cozy-vpa-for-vpa that the parent helm install applies and waits on. That nested HR had `dependsOn: monitoring-agents`, which never resolves: parent VPA helm install waits for nested vpa-for-vpa HR Ready waits for monitoring-agents HR Ready waits for cozystack.vertical-pod-autoscaler PackageSource Ready waits for parent VPA HR Ready <-- back to start Symptom observed on PR #2619 e2e (cozyreport): Helm upgrade failed for release cozy-vertical-pod-autoscaler/ vertical-pod-autoscaler with chart cozy-vertical-pod-autoscaler@...: timeout waiting for: [HelmRelease/cozy-vpa-for-vpa/vpa-for-vpa status: 'InProgress'] The recommender's /health-check readiness probe is served by the binary itself and doesn't require Prometheus. Removing the dependsOn lets the nested HR become Ready quickly; the recommender will log connection errors against vmselect until monitoring-agents installs later in the boot sequence, then start producing recommendations normally. Assisted-By: Claude Signed-off-by: Myasnikov Daniil (cherry picked from commit 08433dc02e7c3463a895914167ce6e853e510584) --- .../templates/vpa-for-vpa.yaml | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/packages/system/vertical-pod-autoscaler/templates/vpa-for-vpa.yaml b/packages/system/vertical-pod-autoscaler/templates/vpa-for-vpa.yaml index 2df053b55..73df18b0d 100644 --- a/packages/system/vertical-pod-autoscaler/templates/vpa-for-vpa.yaml +++ b/packages/system/vertical-pod-autoscaler/templates/vpa-for-vpa.yaml @@ -20,9 +20,14 @@ spec: kind: ExternalArtifact name: cozystack-vertical-pod-autoscaler-default-vpa-for-vpa namespace: cozy-system - dependsOn: - - name: monitoring-agents - namespace: cozy-monitoring + # Do NOT add dependsOn: monitoring-agents — it creates a circular wait: + # helm install of the parent vertical-pod-autoscaler HR waits for this nested + # HR's Ready condition; this HR waits for monitoring-agents; monitoring-agents + # PackageSource waits for cozystack.vertical-pod-autoscaler Ready; that waits + # for the parent HR. The recommender's /health-check probe is served by the + # binary itself and doesn't require Prometheus, so the pod becomes Ready + # immediately and starts producing recommendations when monitoring-agents + # finishes installing later. install: crds: Skip remediation: From f6c73798354b3438277e3b9b36cc41bcc194e587 Mon Sep 17 00:00:00 2001 From: Myasnikov Daniil Date: Wed, 13 May 2026 21:39:53 +0500 Subject: [PATCH 09/28] fix(kubernetes): drop lookup-guarded parent-HR dependsOn on tenant addon child HRs Each of the 19 child HR templates in packages/apps/kubernetes/templates/ helmreleases/ added the parent kubernetes-application HR as a dependsOn entry, guarded by a `lookup "helm.toolkit.fluxcd.io/v2" "HelmRelease"` on the parent so it only stamped after the parent already existed. Under Flux 2.7 (helm-controller v1.4.x), the parent HR's Ready=True flips after helm install returns, regardless of any child HRs it just applied, so the guard was a no-op for first install and a soft ordering hint for subsequent reconciles. Under Flux 2.8 (helm-controller v1.5.0), the default waitStrategy is `poller` -- the parent HR now waits via kstatus for every applied resource, including the 19 child HRs, to be Ready=True before flipping its own Ready. The child HRs in turn cannot become Ready until they have a working `super-admin.svc` kubeConfig and the lookup-stamped dependsOn back-edge resolves -- which only happens after the parent HR is Ready. Deadlock: parent waits on child, child waits on parent. Removing the parent dependsOn from each child breaks the cycle. The children start reconciling immediately; helm-controller's existing retry loop covers the brief window before the parent's helm install lands the admin-kubeconfig secret. The cross-child ordering (cilium -> cert-manager, prometheus-operator-crds -> metrics-server, etc.) stays intact via the unconditional sibling entries. Five files (the *-crds and vsnap-crd HRs) had only the parent reference under dependsOn; remove \`dependsOn:\` entirely in those. Cilium had one conditional gateway-api-crds entry under it; pull the \`dependsOn:\` key inside that conditional so it disappears when gateway-API is off rather than rendering as a null array. This is option B from issue #2642 task 1. Verified: - \`helm template\` clean with default values-ci.yaml and with every addon enabled (cert-manager, ingress-nginx, monitoring-agents, velero, fluxcd, gateway-api, gpu-operator, hami, ouroboros). - No remaining \`- name: {{ .Release.Name }}\` dependsOn entries in packages/apps/kubernetes/templates/helmreleases/. - \`helm unittest\` passes (123/123). Refs: #2642 Assisted-By: Claude Signed-off-by: Myasnikov Daniil (cherry picked from commit 6119aafcb5cb8f6fe19a668009ca898538e8282c) --- .../templates/helmreleases/cert-manager-crds.yaml | 5 ----- .../kubernetes/templates/helmreleases/cert-manager.yaml | 4 ---- .../apps/kubernetes/templates/helmreleases/cilium.yaml | 6 +----- .../apps/kubernetes/templates/helmreleases/coredns.yaml | 4 ---- packages/apps/kubernetes/templates/helmreleases/csi.yaml | 4 ---- .../apps/kubernetes/templates/helmreleases/fluxcd.yaml | 8 -------- .../templates/helmreleases/gateway-api-crds.yaml | 5 ----- .../kubernetes/templates/helmreleases/gpu-operator.yaml | 4 ---- packages/apps/kubernetes/templates/helmreleases/hami.yaml | 4 ---- .../kubernetes/templates/helmreleases/ingress-nginx.yaml | 4 ---- .../kubernetes/templates/helmreleases/metrics-server.yaml | 4 ---- .../templates/helmreleases/monitoring-agents.yaml | 4 ---- .../apps/kubernetes/templates/helmreleases/ouroboros.yaml | 4 ---- .../templates/helmreleases/prometheus-operator-crds.yaml | 5 ----- .../apps/kubernetes/templates/helmreleases/velero.yaml | 4 ---- .../helmreleases/vertical-pod-autoscaler-crds.yaml | 6 ------ .../templates/helmreleases/vertical-pod-autoscaler.yaml | 4 ---- .../templates/helmreleases/victoria-metrics-operator.yaml | 4 ---- .../templates/helmreleases/volumesnapshot-crd.yaml | 5 ----- 19 files changed, 1 insertion(+), 87 deletions(-) diff --git a/packages/apps/kubernetes/templates/helmreleases/cert-manager-crds.yaml b/packages/apps/kubernetes/templates/helmreleases/cert-manager-crds.yaml index e6dfc6641..b27067be8 100644 --- a/packages/apps/kubernetes/templates/helmreleases/cert-manager-crds.yaml +++ b/packages/apps/kubernetes/templates/helmreleases/cert-manager-crds.yaml @@ -35,11 +35,6 @@ spec: valuesKey: values {{- end }} - dependsOn: - {{- if lookup "helm.toolkit.fluxcd.io/v2" "HelmRelease" .Release.Namespace .Release.Name }} - - name: {{ .Release.Name }} - namespace: {{ .Release.Namespace }} - {{- end }} {{- if .Values.addons.certManager.valuesOverride }} --- apiVersion: v1 diff --git a/packages/apps/kubernetes/templates/helmreleases/cert-manager.yaml b/packages/apps/kubernetes/templates/helmreleases/cert-manager.yaml index 060bf117e..256a59220 100644 --- a/packages/apps/kubernetes/templates/helmreleases/cert-manager.yaml +++ b/packages/apps/kubernetes/templates/helmreleases/cert-manager.yaml @@ -41,10 +41,6 @@ spec: values: {{- toYaml (deepCopy .Values.addons.certManager.valuesOverride | mergeOverwrite (fromYaml (include "cozystack.defaultCertManagerValues" .))) | nindent 4 }} dependsOn: - {{- if lookup "helm.toolkit.fluxcd.io/v2" "HelmRelease" .Release.Namespace .Release.Name }} - - name: {{ .Release.Name }} - namespace: {{ .Release.Namespace }} - {{- end }} - name: {{ .Release.Name }}-cilium namespace: {{ .Release.Namespace }} - name: {{ .Release.Name }}-cert-manager-crds diff --git a/packages/apps/kubernetes/templates/helmreleases/cilium.yaml b/packages/apps/kubernetes/templates/helmreleases/cilium.yaml index db48ac73c..5b69e2f29 100644 --- a/packages/apps/kubernetes/templates/helmreleases/cilium.yaml +++ b/packages/apps/kubernetes/templates/helmreleases/cilium.yaml @@ -46,12 +46,8 @@ spec: retries: -1 values: {{- toYaml (deepCopy .Values.addons.cilium.valuesOverride | mergeOverwrite (fromYaml (include "cozystack.defaultCiliumValues" .))) | nindent 4 }} - dependsOn: - {{- if lookup "helm.toolkit.fluxcd.io/v2" "HelmRelease" .Release.Namespace .Release.Name }} - - name: {{ .Release.Name }} - namespace: {{ .Release.Namespace }} - {{- end }} {{- if $.Values.addons.gatewayAPI.enabled }} + dependsOn: - name: {{ .Release.Name }}-gateway-api-crds namespace: {{ .Release.Namespace }} {{- end }} diff --git a/packages/apps/kubernetes/templates/helmreleases/coredns.yaml b/packages/apps/kubernetes/templates/helmreleases/coredns.yaml index 41b5e67c2..0ade90341 100644 --- a/packages/apps/kubernetes/templates/helmreleases/coredns.yaml +++ b/packages/apps/kubernetes/templates/helmreleases/coredns.yaml @@ -36,10 +36,6 @@ spec: values: {{- toYaml (deepCopy .Values.addons.coredns.valuesOverride | mergeOverwrite (fromYaml (include "cozystack.defaultCoreDNSValues" .))) | nindent 4 }} dependsOn: - {{- if lookup "helm.toolkit.fluxcd.io/v2" "HelmRelease" .Release.Namespace .Release.Name }} - - name: {{ .Release.Name }} - namespace: {{ .Release.Namespace }} - {{- end }} - name: {{ .Release.Name }}-cilium namespace: {{ .Release.Namespace }} {{- end }} diff --git a/packages/apps/kubernetes/templates/helmreleases/csi.yaml b/packages/apps/kubernetes/templates/helmreleases/csi.yaml index 109d78e13..e9f973054 100644 --- a/packages/apps/kubernetes/templates/helmreleases/csi.yaml +++ b/packages/apps/kubernetes/templates/helmreleases/csi.yaml @@ -36,8 +36,4 @@ spec: namespace: {{ .Release.Namespace }} - name: {{ .Release.Name }}-cilium namespace: {{ .Release.Namespace }} - {{- if lookup "helm.toolkit.fluxcd.io/v2" "HelmRelease" .Release.Namespace .Release.Name }} - - name: {{ .Release.Name }} - namespace: {{ .Release.Namespace }} - {{- end }} {{- end }} diff --git a/packages/apps/kubernetes/templates/helmreleases/fluxcd.yaml b/packages/apps/kubernetes/templates/helmreleases/fluxcd.yaml index 6c9712c14..7ac75d3b5 100644 --- a/packages/apps/kubernetes/templates/helmreleases/fluxcd.yaml +++ b/packages/apps/kubernetes/templates/helmreleases/fluxcd.yaml @@ -34,10 +34,6 @@ spec: tolerations: [] hostNetwork: false dependsOn: - {{- if lookup "helm.toolkit.fluxcd.io/v2" "HelmRelease" .Release.Namespace .Release.Name }} - - name: {{ .Release.Name }} - namespace: {{ .Release.Namespace }} - {{- end }} - name: {{ .Release.Name }}-cilium namespace: {{ .Release.Namespace }} --- @@ -73,10 +69,6 @@ spec: {{- toYaml . | nindent 4 }} {{- end }} dependsOn: - {{- if lookup "helm.toolkit.fluxcd.io/v2" "HelmRelease" .Release.Namespace .Release.Name }} - - name: {{ .Release.Name }} - namespace: {{ .Release.Namespace }} - {{- end }} - name: {{ .Release.Name }}-cilium namespace: {{ .Release.Namespace }} - name: {{ .Release.Name }}-fluxcd-operator diff --git a/packages/apps/kubernetes/templates/helmreleases/gateway-api-crds.yaml b/packages/apps/kubernetes/templates/helmreleases/gateway-api-crds.yaml index f82923fe6..65d52b1ca 100644 --- a/packages/apps/kubernetes/templates/helmreleases/gateway-api-crds.yaml +++ b/packages/apps/kubernetes/templates/helmreleases/gateway-api-crds.yaml @@ -27,9 +27,4 @@ spec: upgrade: remediation: retries: -1 - dependsOn: - {{- if lookup "helm.toolkit.fluxcd.io/v2" "HelmRelease" .Release.Namespace .Release.Name }} - - name: {{ .Release.Name }} - namespace: {{ .Release.Namespace }} - {{- end }} {{- end }} diff --git a/packages/apps/kubernetes/templates/helmreleases/gpu-operator.yaml b/packages/apps/kubernetes/templates/helmreleases/gpu-operator.yaml index 5368dc83e..ef2a1c64a 100644 --- a/packages/apps/kubernetes/templates/helmreleases/gpu-operator.yaml +++ b/packages/apps/kubernetes/templates/helmreleases/gpu-operator.yaml @@ -45,10 +45,6 @@ spec: {{- end }} dependsOn: - {{- if lookup "helm.toolkit.fluxcd.io/v2" "HelmRelease" .Release.Namespace .Release.Name }} - - name: {{ .Release.Name }} - namespace: {{ .Release.Namespace }} - {{- end }} - name: {{ .Release.Name }}-cilium namespace: {{ .Release.Namespace }} {{- end }} diff --git a/packages/apps/kubernetes/templates/helmreleases/hami.yaml b/packages/apps/kubernetes/templates/helmreleases/hami.yaml index 32c375a5d..635f061f8 100644 --- a/packages/apps/kubernetes/templates/helmreleases/hami.yaml +++ b/packages/apps/kubernetes/templates/helmreleases/hami.yaml @@ -37,10 +37,6 @@ spec: {{- end }} dependsOn: - {{- if lookup "helm.toolkit.fluxcd.io/v2" "HelmRelease" .Release.Namespace .Release.Name }} - - name: {{ .Release.Name }} - namespace: {{ .Release.Namespace }} - {{- end }} - name: {{ .Release.Name }}-cilium namespace: {{ .Release.Namespace }} - name: {{ .Release.Name }}-gpu-operator diff --git a/packages/apps/kubernetes/templates/helmreleases/ingress-nginx.yaml b/packages/apps/kubernetes/templates/helmreleases/ingress-nginx.yaml index 8432aea04..e87ab79b0 100644 --- a/packages/apps/kubernetes/templates/helmreleases/ingress-nginx.yaml +++ b/packages/apps/kubernetes/templates/helmreleases/ingress-nginx.yaml @@ -53,10 +53,6 @@ spec: values: {{- toYaml (deepCopy .Values.addons.ingressNginx.valuesOverride | mergeOverwrite (fromYaml (include "cozystack.defaultIngressValues" .))) | nindent 4 }} dependsOn: - {{- if lookup "helm.toolkit.fluxcd.io/v2" "HelmRelease" .Release.Namespace .Release.Name }} - - name: {{ .Release.Name }} - namespace: {{ .Release.Namespace }} - {{- end }} - name: {{ .Release.Name }}-cilium namespace: {{ .Release.Namespace }} {{- end }} diff --git a/packages/apps/kubernetes/templates/helmreleases/metrics-server.yaml b/packages/apps/kubernetes/templates/helmreleases/metrics-server.yaml index 3e6f96601..50e7d695d 100644 --- a/packages/apps/kubernetes/templates/helmreleases/metrics-server.yaml +++ b/packages/apps/kubernetes/templates/helmreleases/metrics-server.yaml @@ -29,10 +29,6 @@ spec: remediation: retries: -1 dependsOn: - {{- if lookup "helm.toolkit.fluxcd.io/v2" "HelmRelease" .Release.Namespace .Release.Name }} - - name: {{ .Release.Name }} - namespace: {{ .Release.Namespace }} - {{- end }} - name: {{ .Release.Name }}-cilium namespace: {{ .Release.Namespace }} - name: {{ .Release.Name }}-prometheus-operator-crds diff --git a/packages/apps/kubernetes/templates/helmreleases/monitoring-agents.yaml b/packages/apps/kubernetes/templates/helmreleases/monitoring-agents.yaml index 695b1d4a9..2ec0bc3ca 100644 --- a/packages/apps/kubernetes/templates/helmreleases/monitoring-agents.yaml +++ b/packages/apps/kubernetes/templates/helmreleases/monitoring-agents.yaml @@ -31,10 +31,6 @@ spec: remediation: retries: -1 dependsOn: - {{- if lookup "helm.toolkit.fluxcd.io/v2" "HelmRelease" .Release.Namespace .Release.Name }} - - name: {{ .Release.Name }} - namespace: {{ .Release.Namespace }} - {{- end }} - name: {{ .Release.Name }}-cozy-victoria-metrics-operator namespace: {{ .Release.Namespace }} - name: {{ .Release.Name }}-vertical-pod-autoscaler-crds diff --git a/packages/apps/kubernetes/templates/helmreleases/ouroboros.yaml b/packages/apps/kubernetes/templates/helmreleases/ouroboros.yaml index 4d7b36d28..09c20aa05 100644 --- a/packages/apps/kubernetes/templates/helmreleases/ouroboros.yaml +++ b/packages/apps/kubernetes/templates/helmreleases/ouroboros.yaml @@ -159,10 +159,6 @@ spec: documented on the OuroborosAddon field. */ -}} {{- toYaml (deepCopy .Values.addons.ouroboros.valuesOverride | mergeOverwrite (fromYaml (include "cozystack.defaultOuroborosValues" .))) | nindent 4 }} dependsOn: - {{- if lookup "helm.toolkit.fluxcd.io/v2" "HelmRelease" .Release.Namespace .Release.Name }} - - name: {{ .Release.Name }} - namespace: {{ .Release.Namespace }} - {{- end }} - name: {{ .Release.Name }}-cilium namespace: {{ .Release.Namespace }} - name: {{ .Release.Name }}-coredns diff --git a/packages/apps/kubernetes/templates/helmreleases/prometheus-operator-crds.yaml b/packages/apps/kubernetes/templates/helmreleases/prometheus-operator-crds.yaml index 3038a058e..3bb0afc7c 100644 --- a/packages/apps/kubernetes/templates/helmreleases/prometheus-operator-crds.yaml +++ b/packages/apps/kubernetes/templates/helmreleases/prometheus-operator-crds.yaml @@ -27,9 +27,4 @@ spec: upgrade: remediation: retries: -1 - dependsOn: - {{- if lookup "helm.toolkit.fluxcd.io/v2" "HelmRelease" .Release.Namespace .Release.Name }} - - name: {{ .Release.Name }} - namespace: {{ .Release.Namespace }} - {{- end }} {{- end }} diff --git a/packages/apps/kubernetes/templates/helmreleases/velero.yaml b/packages/apps/kubernetes/templates/helmreleases/velero.yaml index c5a32119e..202e89b6f 100644 --- a/packages/apps/kubernetes/templates/helmreleases/velero.yaml +++ b/packages/apps/kubernetes/templates/helmreleases/velero.yaml @@ -34,10 +34,6 @@ spec: {{- end }} dependsOn: - {{- if lookup "helm.toolkit.fluxcd.io/v2" "HelmRelease" .Release.Namespace .Release.Name }} - - name: {{ .Release.Name }} - namespace: {{ .Release.Namespace }} - {{- end }} - name: {{ .Release.Name }}-cilium namespace: {{ .Release.Namespace }} {{- end }} diff --git a/packages/apps/kubernetes/templates/helmreleases/vertical-pod-autoscaler-crds.yaml b/packages/apps/kubernetes/templates/helmreleases/vertical-pod-autoscaler-crds.yaml index 55a5faace..630e58e16 100644 --- a/packages/apps/kubernetes/templates/helmreleases/vertical-pod-autoscaler-crds.yaml +++ b/packages/apps/kubernetes/templates/helmreleases/vertical-pod-autoscaler-crds.yaml @@ -27,10 +27,4 @@ spec: upgrade: remediation: retries: -1 - - dependsOn: - {{- if lookup "helm.toolkit.fluxcd.io/v2" "HelmRelease" .Release.Namespace .Release.Name }} - - name: {{ .Release.Name }} - namespace: {{ .Release.Namespace }} - {{- end }} {{- end }} diff --git a/packages/apps/kubernetes/templates/helmreleases/vertical-pod-autoscaler.yaml b/packages/apps/kubernetes/templates/helmreleases/vertical-pod-autoscaler.yaml index 10428b650..58eeba315 100644 --- a/packages/apps/kubernetes/templates/helmreleases/vertical-pod-autoscaler.yaml +++ b/packages/apps/kubernetes/templates/helmreleases/vertical-pod-autoscaler.yaml @@ -57,10 +57,6 @@ spec: values: {{- toYaml (deepCopy .Values.addons.verticalPodAutoscaler.valuesOverride | mergeOverwrite (fromYaml (include "cozystack.defaultVPAValues" .))) | nindent 4 }} dependsOn: - {{- if lookup "helm.toolkit.fluxcd.io/v2" "HelmRelease" .Release.Namespace .Release.Name }} - - name: {{ .Release.Name }} - namespace: {{ .Release.Namespace }} - {{- end }} - name: {{ .Release.Name }}-monitoring-agents namespace: {{ .Release.Namespace }} {{- end }} diff --git a/packages/apps/kubernetes/templates/helmreleases/victoria-metrics-operator.yaml b/packages/apps/kubernetes/templates/helmreleases/victoria-metrics-operator.yaml index 0bab0b420..d6c068ca6 100644 --- a/packages/apps/kubernetes/templates/helmreleases/victoria-metrics-operator.yaml +++ b/packages/apps/kubernetes/templates/helmreleases/victoria-metrics-operator.yaml @@ -29,10 +29,6 @@ spec: remediation: retries: -1 dependsOn: - {{- if lookup "helm.toolkit.fluxcd.io/v2" "HelmRelease" .Release.Namespace .Release.Name }} - - name: {{ .Release.Name }} - namespace: {{ .Release.Namespace }} - {{- end }} - name: {{ .Release.Name }}-cilium namespace: {{ .Release.Namespace }} - name: {{ .Release.Name }}-cert-manager-crds diff --git a/packages/apps/kubernetes/templates/helmreleases/volumesnapshot-crd.yaml b/packages/apps/kubernetes/templates/helmreleases/volumesnapshot-crd.yaml index a70b6752e..9848c7d45 100644 --- a/packages/apps/kubernetes/templates/helmreleases/volumesnapshot-crd.yaml +++ b/packages/apps/kubernetes/templates/helmreleases/volumesnapshot-crd.yaml @@ -28,9 +28,4 @@ spec: upgrade: remediation: retries: -1 - dependsOn: - {{- if lookup "helm.toolkit.fluxcd.io/v2" "HelmRelease" .Release.Namespace .Release.Name }} - - name: {{ .Release.Name }} - namespace: {{ .Release.Namespace }} - {{- end }} {{- end }} From 7b9f286faaeeeee960496df5571eba0802ff99f8 Mon Sep 17 00:00:00 2001 From: Myasnikov Daniil Date: Thu, 14 May 2026 14:44:32 +0500 Subject: [PATCH 10/28] test(e2e): bump app HR-Ready waits for Flux v2.8 kstatus MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Flux helm-controller v1.5.0 (shipped in Flux v2.8) replaced the legacy Helm readiness logic with kstatus-based health checking, which polls Deployment/StatefulSet/Service status and waits for kstatus to assess rollout-ready. This typically adds 10-30s of latency between resource apply and HR condition Ready=True compared to v2.7. Our per-app bats tests had `kubectl wait hr/... --for=condition=ready --timeout=` budgets of 20s, 30s, 60s, 100s — sized for v2.7's faster readiness flip and previously masked by the 3x retry on Run E2E tests (dropped in #2558). Under v2.8 with no retry, every app that runs after the first few hit its HR wait timeout exactly, surfacing as 13 of 16 test failures on PR #2619. Standardise on 5m for HR Ready across all app tests. Tight enough to catch genuine bring-up failures within the per-app job budget, loose enough to absorb kstatus dispatch jitter on a management cluster that is concurrently reconciling multiple tenant-test HRs. Post-HR-Ready checks for app-specific resources (StatefulSet/Service/ PVC/operator CRs) remain — for CR-based apps kstatus only observes that the chart applied, not that the operator finished. Audit of which of those are actually redundant under v2.8 kstatus is queued as a follow-up. Also bumps the 10s "kamajicontrolplane appears" wait in run-kubernetes.sh to 2m, and the kubernetes-addon HR Ready loop from 1m to 5m for the same reason. Assisted-By: Claude Signed-off-by: Myasnikov Daniil (cherry picked from commit 5ef02ee7b3becc231d855a5b6786457b7e351f7a) --- hack/e2e-apps/bucket.bats | 2 +- hack/e2e-apps/clickhouse.bats | 2 +- hack/e2e-apps/etcd.bats | 2 +- hack/e2e-apps/external-dns.bats | 8 ++++---- hack/e2e-apps/harbor.bats | 2 +- hack/e2e-apps/kafka.bats | 2 +- hack/e2e-apps/mariadb.bats | 2 +- hack/e2e-apps/mongodb.bats | 2 +- hack/e2e-apps/openbao.bats | 4 ++-- hack/e2e-apps/postgres.bats | 2 +- hack/e2e-apps/qdrant.bats | 4 ++-- hack/e2e-apps/redis.bats | 2 +- hack/e2e-apps/vminstance.bats | 8 ++++---- 13 files changed, 21 insertions(+), 21 deletions(-) diff --git a/hack/e2e-apps/bucket.bats b/hack/e2e-apps/bucket.bats index a4a349d71..9fd127ee9 100644 --- a/hack/e2e-apps/bucket.bats +++ b/hack/e2e-apps/bucket.bats @@ -19,7 +19,7 @@ spec: EOF # Wait for the bucket to be ready - kubectl -n tenant-test wait hr bucket-${name} --timeout=100s --for=condition=ready + kubectl -n tenant-test wait hr bucket-${name} --timeout=5m --for=condition=ready timeout 60 sh -ec "until kubectl -n tenant-test get bucketclaims.objectstorage.k8s.io bucket-${name} >/dev/null 2>&1; do sleep 2; done" kubectl -n tenant-test wait bucketclaims.objectstorage.k8s.io bucket-${name} --timeout=300s --for=jsonpath='{.status.bucketReady}' timeout 60 sh -ec "until kubectl -n tenant-test get bucketaccesses.objectstorage.k8s.io bucket-${name}-admin >/dev/null 2>&1; do sleep 2; done" diff --git a/hack/e2e-apps/clickhouse.bats b/hack/e2e-apps/clickhouse.bats index 733da0fff..72400867a 100644 --- a/hack/e2e-apps/clickhouse.bats +++ b/hack/e2e-apps/clickhouse.bats @@ -38,7 +38,7 @@ EOF # Wait for the operator to materialise the HelmRelease before kubectl wait # kicks in (kubectl wait errors immediately if the object does not exist yet). timeout 60 sh -ec "until kubectl -n tenant-test get hr clickhouse-$name >/dev/null 2>&1; do sleep 2; done" - kubectl -n tenant-test wait hr clickhouse-$name --timeout=20s --for=condition=ready + kubectl -n tenant-test wait hr clickhouse-$name --timeout=5m --for=condition=ready timeout 180 sh -ec "until kubectl -n tenant-test get svc chendpoint-clickhouse-$name -o jsonpath='{.spec.ports[*].port}' | grep -q '8123 9000'; do sleep 10; done" timeout 60 sh -ec "until kubectl -n tenant-test get statefulset.apps/chi-clickhouse-$name-clickhouse-0-0 >/dev/null 2>&1; do sleep 2; done" kubectl -n tenant-test wait statefulset.apps/chi-clickhouse-$name-clickhouse-0-0 --timeout=120s --for=jsonpath='{.status.replicas}'=1 diff --git a/hack/e2e-apps/etcd.bats b/hack/e2e-apps/etcd.bats index abc290dbb..7dcfd73fa 100644 --- a/hack/e2e-apps/etcd.bats +++ b/hack/e2e-apps/etcd.bats @@ -26,7 +26,7 @@ dump_diagnostics() { # resource, so poll for existence first. wait_etcd_hr_ready() { timeout 60 sh -ec 'until kubectl -n tenant-test get hr/etcd >/dev/null 2>&1; do sleep 2; done' - kubectl -n tenant-test wait hr/etcd --timeout=60s --for=condition=ready + kubectl -n tenant-test wait hr/etcd --timeout=5m --for=condition=ready } @test "Create Etcd" { diff --git a/hack/e2e-apps/external-dns.bats b/hack/e2e-apps/external-dns.bats index 5775927f3..b1bc71a57 100644 --- a/hack/e2e-apps/external-dns.bats +++ b/hack/e2e-apps/external-dns.bats @@ -21,8 +21,8 @@ EOF # Wait for the operator to materialise the HelmRelease before kubectl wait # kicks in (kubectl wait errors immediately if the object does not exist yet). timeout 60 sh -ec "until kubectl -n tenant-test get hr ${name} >/dev/null 2>&1; do sleep 2; done" - kubectl -n tenant-test wait hr ${name} --timeout=120s --for=condition=ready - kubectl -n tenant-test wait hr ${name}-system --timeout=120s --for=condition=ready + kubectl -n tenant-test wait hr ${name} --timeout=5m --for=condition=ready + kubectl -n tenant-test wait hr ${name}-system --timeout=5m --for=condition=ready timeout 60 sh -ec "until kubectl -n tenant-test get deploy -l app.kubernetes.io/instance=${name}-system -o jsonpath='{.items[0].status.readyReplicas}' | grep -q '1'; do sleep 5; done" kubectl -n tenant-test delete externaldns.apps.cozystack.io ${name} @@ -46,8 +46,8 @@ EOF # Wait for the operator to materialise the HelmRelease before kubectl wait # kicks in (kubectl wait errors immediately if the object does not exist yet). timeout 60 sh -ec "until kubectl -n tenant-test get hr ${name} >/dev/null 2>&1; do sleep 2; done" - kubectl -n tenant-test wait hr ${name} --timeout=120s --for=condition=ready - kubectl -n tenant-test wait hr ${name}-system --timeout=120s --for=condition=ready + kubectl -n tenant-test wait hr ${name} --timeout=5m --for=condition=ready + kubectl -n tenant-test wait hr ${name}-system --timeout=5m --for=condition=ready timeout 60 sh -ec "until kubectl -n tenant-test get deploy -l app.kubernetes.io/instance=${name}-system -o jsonpath='{.items[0].status.readyReplicas}' | grep -q '1'; do sleep 5; done" kubectl -n tenant-test delete externaldns.apps.cozystack.io ${name} diff --git a/hack/e2e-apps/harbor.bats b/hack/e2e-apps/harbor.bats index 290fef425..10ad3c95c 100644 --- a/hack/e2e-apps/harbor.bats +++ b/hack/e2e-apps/harbor.bats @@ -41,7 +41,7 @@ EOF # Wait for the operator to materialise the HelmRelease before kubectl wait # kicks in (kubectl wait errors immediately if the object does not exist yet). timeout 60 sh -ec "until kubectl -n tenant-test get hr $release >/dev/null 2>&1; do sleep 2; done" - kubectl -n tenant-test wait hr $release --timeout=60s --for=condition=ready + kubectl -n tenant-test wait hr $release --timeout=5m --for=condition=ready # Wait for COSI to provision bucket timeout 60 sh -ec "until kubectl -n tenant-test get bucketclaims.objectstorage.k8s.io $release-registry >/dev/null 2>&1; do sleep 2; done" diff --git a/hack/e2e-apps/kafka.bats b/hack/e2e-apps/kafka.bats index ef4d9187c..d0a8266b9 100644 --- a/hack/e2e-apps/kafka.bats +++ b/hack/e2e-apps/kafka.bats @@ -42,7 +42,7 @@ EOF # Wait for the operator to materialise the HelmRelease before kubectl wait # kicks in (kubectl wait errors immediately if the object does not exist yet). timeout 60 sh -ec "until kubectl -n tenant-test get hr kafka-$name >/dev/null 2>&1; do sleep 2; done" - kubectl -n tenant-test wait hr kafka-$name --timeout=30s --for=condition=ready + kubectl -n tenant-test wait hr kafka-$name --timeout=5m --for=condition=ready timeout 60 sh -ec "until kubectl -n tenant-test get kafkas $name >/dev/null 2>&1; do sleep 2; done" kubectl wait kafkas -n tenant-test $name --timeout=300s --for=condition=ready timeout 60 sh -ec "until kubectl -n tenant-test get pvc data-kafka-$name-zookeeper-0; do sleep 10; done" diff --git a/hack/e2e-apps/mariadb.bats b/hack/e2e-apps/mariadb.bats index 35559216e..0c1e3a5e8 100644 --- a/hack/e2e-apps/mariadb.bats +++ b/hack/e2e-apps/mariadb.bats @@ -38,7 +38,7 @@ EOF # Wait for the operator to materialise the HelmRelease before kubectl wait # kicks in (kubectl wait errors immediately if the object does not exist yet). timeout 60 sh -ec "until kubectl -n tenant-test get hr mariadb-$name >/dev/null 2>&1; do sleep 2; done" - kubectl -n tenant-test wait hr mariadb-$name --timeout=30s --for=condition=ready + kubectl -n tenant-test wait hr mariadb-$name --timeout=5m --for=condition=ready timeout 80 sh -ec "until kubectl -n tenant-test get svc mariadb-$name -o jsonpath='{.spec.ports[0].port}' | grep -q '3306'; do sleep 10; done" timeout 80 sh -ec "until kubectl -n tenant-test get endpoints mariadb-$name -o jsonpath='{.subsets[*].addresses[*].ip}' | grep -q '[0-9]'; do sleep 10; done" timeout 60 sh -ec "until kubectl -n tenant-test get statefulset.apps/mariadb-$name >/dev/null 2>&1; do sleep 2; done" diff --git a/hack/e2e-apps/mongodb.bats b/hack/e2e-apps/mongodb.bats index bc83f7ab7..0750e4317 100644 --- a/hack/e2e-apps/mongodb.bats +++ b/hack/e2e-apps/mongodb.bats @@ -30,7 +30,7 @@ EOF # kicks in (kubectl wait errors immediately if the object does not exist yet). timeout 60 sh -ec "until kubectl -n tenant-test get hr mongodb-$name >/dev/null 2>&1; do sleep 2; done" # Wait for HelmRelease - kubectl -n tenant-test wait hr mongodb-$name --timeout=60s --for=condition=ready + kubectl -n tenant-test wait hr mongodb-$name --timeout=5m --for=condition=ready # Wait for MongoDB service (port 27017) timeout 120 sh -ec "until kubectl -n tenant-test get svc mongodb-$name-rs0 -o jsonpath='{.spec.ports[0].port}' | grep -q '27017'; do sleep 10; done" # Wait for endpoints diff --git a/hack/e2e-apps/openbao.bats b/hack/e2e-apps/openbao.bats index 168440ade..81ca42b3e 100644 --- a/hack/e2e-apps/openbao.bats +++ b/hack/e2e-apps/openbao.bats @@ -21,8 +21,8 @@ EOF # Wait for the operator to materialise the HelmRelease before kubectl wait # kicks in (kubectl wait errors immediately if the object does not exist yet). timeout 60 sh -ec "until kubectl -n tenant-test get hr openbao-$name >/dev/null 2>&1; do sleep 2; done" - kubectl -n tenant-test wait hr openbao-$name --timeout=60s --for=condition=ready - kubectl -n tenant-test wait hr openbao-$name-system --timeout=120s --for=condition=ready + kubectl -n tenant-test wait hr openbao-$name --timeout=5m --for=condition=ready + kubectl -n tenant-test wait hr openbao-$name-system --timeout=5m --for=condition=ready # Wait for container to be started (pod Running does not guarantee container is ready for exec on slow CI) if ! timeout 120 sh -ec "until kubectl -n tenant-test get pod openbao-$name-0 --output jsonpath='{.status.containerStatuses[0].started}' 2>/dev/null | grep -q true; do sleep 5; done"; then diff --git a/hack/e2e-apps/postgres.bats b/hack/e2e-apps/postgres.bats index bdd63c900..44c0c5bd7 100644 --- a/hack/e2e-apps/postgres.bats +++ b/hack/e2e-apps/postgres.bats @@ -43,7 +43,7 @@ EOF # Wait for the operator to materialise the HelmRelease before kubectl wait # kicks in (kubectl wait errors immediately if the object does not exist yet). timeout 60 sh -ec "until kubectl -n tenant-test get hr postgres-$name >/dev/null 2>&1; do sleep 2; done" - kubectl -n tenant-test wait hr postgres-$name --timeout=100s --for=condition=ready + kubectl -n tenant-test wait hr postgres-$name --timeout=5m --for=condition=ready timeout 60 sh -ec "until kubectl -n tenant-test get job.batch postgres-$name-init-job >/dev/null 2>&1; do sleep 2; done" kubectl -n tenant-test wait job.batch postgres-$name-init-job --timeout=50s --for=condition=Complete timeout 40 sh -ec "until kubectl -n tenant-test get svc postgres-$name-r -o jsonpath='{.spec.ports[0].port}' | grep -q '5432'; do sleep 10; done" diff --git a/hack/e2e-apps/qdrant.bats b/hack/e2e-apps/qdrant.bats index 8a889e439..7d031a1d7 100755 --- a/hack/e2e-apps/qdrant.bats +++ b/hack/e2e-apps/qdrant.bats @@ -20,8 +20,8 @@ EOF # Wait for the operator to materialise the HelmRelease before kubectl wait # kicks in (kubectl wait errors immediately if the object does not exist yet). timeout 60 sh -ec "until kubectl -n tenant-test get hr qdrant-$name >/dev/null 2>&1; do sleep 2; done" - kubectl -n tenant-test wait hr qdrant-$name --timeout=60s --for=condition=ready - kubectl -n tenant-test wait hr qdrant-$name-system --timeout=120s --for=condition=ready + kubectl -n tenant-test wait hr qdrant-$name --timeout=5m --for=condition=ready + kubectl -n tenant-test wait hr qdrant-$name-system --timeout=5m --for=condition=ready timeout 60 sh -ec "until kubectl -n tenant-test get sts qdrant-$name >/dev/null 2>&1; do sleep 2; done" kubectl -n tenant-test wait sts qdrant-$name --timeout=90s --for=jsonpath='{.status.readyReplicas}'=1 timeout 60 sh -ec "until kubectl -n tenant-test get pvc qdrant-storage-qdrant-$name-0 >/dev/null 2>&1; do sleep 2; done" diff --git a/hack/e2e-apps/redis.bats b/hack/e2e-apps/redis.bats index eb148701f..98eb4595e 100644 --- a/hack/e2e-apps/redis.bats +++ b/hack/e2e-apps/redis.bats @@ -21,7 +21,7 @@ EOF # Wait for the operator to materialise the HelmRelease before kubectl wait # kicks in (kubectl wait errors immediately if the object does not exist yet). timeout 60 sh -ec "until kubectl -n tenant-test get hr redis-$name >/dev/null 2>&1; do sleep 2; done" - kubectl -n tenant-test wait hr redis-$name --timeout=20s --for=condition=ready + kubectl -n tenant-test wait hr redis-$name --timeout=5m --for=condition=ready timeout 60 sh -ec "until kubectl -n tenant-test get pvc redisfailover-persistent-data-rfr-redis-$name-0 >/dev/null 2>&1; do sleep 2; done" kubectl -n tenant-test wait pvc redisfailover-persistent-data-rfr-redis-$name-0 --timeout=50s --for=jsonpath='{.status.phase}'=Bound timeout 60 sh -ec "until kubectl -n tenant-test get deploy rfs-redis-$name >/dev/null 2>&1; do sleep 2; done" diff --git a/hack/e2e-apps/vminstance.bats b/hack/e2e-apps/vminstance.bats index 15148c473..b85c0ebf2 100644 --- a/hack/e2e-apps/vminstance.bats +++ b/hack/e2e-apps/vminstance.bats @@ -28,7 +28,7 @@ EOF # Wait for the operator to materialise the HelmRelease before kubectl wait # kicks in (kubectl wait errors immediately if the object does not exist yet). timeout 60 sh -ec "until kubectl -n tenant-test get hr vm-disk-$name >/dev/null 2>&1; do sleep 2; done" - kubectl -n tenant-test wait hr vm-disk-$name --timeout=60s --for=condition=ready + kubectl -n tenant-test wait hr vm-disk-$name --timeout=5m --for=condition=ready kubectl -n tenant-test wait dv vm-disk-$name --timeout=250s --for=condition=ready kubectl -n tenant-test wait pvc vm-disk-$name --timeout=200s --for=jsonpath='{.status.phase}'=Bound # Drop the VMDisk so the next test starts from a clean slate. Each test @@ -63,7 +63,7 @@ spec: storageClass: replicated EOF timeout 60 sh -ec "until kubectl -n tenant-test get hr vm-disk-$diskName >/dev/null 2>&1; do sleep 2; done" - kubectl -n tenant-test wait hr vm-disk-$diskName --timeout=60s --for=condition=ready + kubectl -n tenant-test wait hr vm-disk-$diskName --timeout=5m --for=condition=ready kubectl -n tenant-test wait dv vm-disk-$diskName --timeout=250s --for=condition=ready kubectl -n tenant-test wait pvc vm-disk-$diskName --timeout=200s --for=jsonpath='{.status.phase}'=Bound kubectl apply -f - < Date: Thu, 14 May 2026 16:28:09 +0500 Subject: [PATCH 11/28] test(e2e): wait for parent HR Ready before downstream asserts Two timing bugs unmasked by Flux v2.8 kstatus, with the same root shape: the bats steps assumed a side-effect ordering ("by the time X is true, the parent HR's helm install is done") that held under v2.7's faster dispatch but breaks under v2.8 where helm-controller walks kstatus on every applied resource before flipping the HR Ready. run-kubernetes.sh: After every addon HR (cilium, coredns, csi, vsnap-crd, ingress-nginx) reaches Ready, the remediation guard reads `.status.history` on the parent kubernetes-${test_name} HR. The parent's helm install can still be Reconciling at that point because kstatus is finishing its full sweep; `.status.history` is empty until install completes, so the guard exits 1 with "empty .status.history on a Ready HR". kubernetes- latest masked this because the ouroboros assertions add ~10m of buffer; kubernetes-previous (no ouroboros) hit the guard with the parent still installing. Add an explicit kubectl wait hr/kubernetes-${test_name} --for=condition=ready before the guard. vminstance.bats: The test waited 120s for `kubectl get vmi vm-instance-$name` to return a VMI with an assigned IP, then waited for the parent HR Ready separately afterwards. Under v2.7 the parent HR's helm install applied the VirtualMachine CR fast enough that kubevirt had created the VMI before the 120s budget expired. Under v2.8 the dispatch is slower and the VMI poll returned NotFound for its entire budget. Reorder: wait for HR Ready first (which implies the VirtualMachine CR is applied + kstatus-ready), then poll for the VMI with IP. Loosen the VMI poll budget from 120s to 5m for nested-virt slow paths. Assisted-By: Claude Signed-off-by: Myasnikov Daniil (cherry picked from commit c664b868bc4acba6ff16bac11f3e856aa72b58cc) --- hack/e2e-apps/run-kubernetes.sh | 9 +++++++++ hack/e2e-apps/vminstance.bats | 13 +++++++++---- 2 files changed, 18 insertions(+), 4 deletions(-) diff --git a/hack/e2e-apps/run-kubernetes.sh b/hack/e2e-apps/run-kubernetes.sh index 39a7f59e0..10a959ac6 100644 --- a/hack/e2e-apps/run-kubernetes.sh +++ b/hack/e2e-apps/run-kubernetes.sh @@ -477,6 +477,15 @@ EOF delete ingress hairpin-probe --ignore-not-found 2>/dev/null || true fi + # Wait for the parent kubernetes-${test_name} HR to be Ready before the + # remediation guard runs. The guard reads `.status.history`, which is empty + # until the helm install action completes — under Flux v2.8 kstatus the + # parent's helm install can still be "Running 'install'" after every child + # HR (cilium, coredns, csi, vsnap-crd, ingress-nginx) is already Ready, + # because kstatus walks all applied resources before flipping the parent + # Ready. + kubectl wait hr -n tenant-test "kubernetes-${test_name}" --timeout=5m --for=condition=ready + # Guard: parent HelmRelease must not have entered an install/upgrade remediation cycle. # A non-zero installFailures/upgradeFailures indicates the helm-wait budget expired while # admin-kubeconfig was still being provisioned, which would trigger uninstall remediation diff --git a/hack/e2e-apps/vminstance.bats b/hack/e2e-apps/vminstance.bats index b85c0ebf2..79b0ef6b9 100644 --- a/hack/e2e-apps/vminstance.bats +++ b/hack/e2e-apps/vminstance.bats @@ -100,11 +100,16 @@ EOF # Wait for the operator to materialise the HelmRelease before downstream # waits proceed (kubectl wait errors immediately if the HR does not exist). timeout 60 sh -ec "until kubectl -n tenant-test get hr vm-instance-$name >/dev/null 2>&1; do sleep 2; done" - # Nested KubeVirt VM startup (virt-launcher + libvirt + cloud-init DHCP) - # routinely takes 30-60s under runner load; the previous 20s was unrealistic - # and produced flakes. 120s is a comfortable upper bound for nested virt. - timeout 120 sh -ec "until kubectl -n tenant-test get vmi vm-instance-$name -o jsonpath='{.status.interfaces[0].ipAddress}' | grep -q '[0-9]'; do sleep 2; done" + # Wait for the parent HR Ready before polling for the VMI. Under Flux v2.8 + # kstatus the helm install can be still dispatching when the previous + # ordering assumed it had already applied the VirtualMachine CR — without + # this the next poll for `vmi vm-instance-$name` returned NotFound for + # its entire 120s budget because kubevirt hadn't seen the VM yet. kubectl -n tenant-test wait hr vm-instance-$name --timeout=5m --for=condition=ready + # Nested KubeVirt VM startup (virt-launcher + libvirt + cloud-init DHCP) + # routinely takes 30-60s under runner load. 5m is a comfortable upper + # bound for nested virt + slow runner I/O after the HR-Ready gate. + timeout 5m sh -ec "until kubectl -n tenant-test get vmi vm-instance-$name -o jsonpath='{.status.interfaces[0].ipAddress}' | grep -q '[0-9]'; do sleep 2; done" # VM ready follows IP assignment closely; 60s gives buffer for the qemu-guest-agent. kubectl -n tenant-test wait vm vm-instance-$name --timeout=5m --for=condition=ready kubectl -n tenant-test delete vminstances.apps.cozystack.io $name --ignore-not-found --timeout=3m From 29c6afc84d43f3b0d0f45a6e17db8a8d83cf0769 Mon Sep 17 00:00:00 2001 From: Myasnikov Daniil Date: Mon, 25 May 2026 11:08:33 +0500 Subject: [PATCH 12/28] refactor(seaweedfs): split seaweedfs-system into seaweedfs-db + seaweedfs-system MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Splits the seaweedfs-system HelmRelease in two so the CNPG Cluster/seaweedfs-db lives in its own HR (seaweedfs-db), and the application HR (seaweedfs-system) dependsOn it. The new HR uses Flux v2 HelmRelease.spec.healthCheckExprs with a CEL expression on Cluster.status.conditions[type=Ready] plus waitStrategy.name: poller, so its Ready=True only flips after the postgres primary is actually serving connections — not just after helm install applied the Cluster CR. This eliminates the seaweedfs-filer CrashLoopBackOff race on a fresh tenant install. With Cilium kubeProxyReplacement: true, socket-LB returns EPERM from connect(2) to ClusterIPs with no Ready endpoints. Pre-split, the filer StatefulSet scheduled concurrently with the CNPG bootstrap (~55–70s of unavailable postgres), each connect() failed EPERM, kubelet exponential restart backoff pushed past the e2e bats 'kubectl wait hr/seaweedfs-system --timeout=2m' window, and the 'Configure Tenant and wait for applications' test failed. healthCheckExprs uses Flux's three-predicate form: route ClusterIsNotReady (the CNPG bootstrap condition) to `inProgress` so the HR keeps polling, keep `failed` for other Ready=False reasons, and rely on the HR `timeout: 10m` as the real backstop for a genuinely stuck cluster. A plain Ready=False predicate would flag the HR failed within seconds of creating the Cluster CR. Migration 42 adopts existing Cluster/seaweedfs-db resources into the new release on upgrade by rewriting meta.helm.sh/release-name and stamping helm.sh/resource-policy: keep so the seaweedfs-system upgrade (which no longer renders the Cluster) does not delete it during the transition. The application HR's dependsOn collapses the db dependency (unconditional) with the existing ingress dependency (guarded by `if eq $ingress .Release.Namespace` so sub-tenants that inherit ingress from a parent namespace don't deadlock on a non-existent local HR) into one list. Requires Flux v2.8.x (helm-controller v1.5.0+) for healthCheckExprs. Provided by the parent PR #2602 in this chain. Co-Authored-By: Claude Opus 4.7 (1M context) Signed-off-by: Myasnikov Daniil --- .../platform/images/migrations/migrations/43 | 32 +++++++++++++ .../sources/seaweedfs-application.yaml | 2 + .../seaweedfs/templates/seaweedfs-db.yaml | 47 +++++++++++++++++++ .../extra/seaweedfs/templates/seaweedfs.yaml | 13 ++--- packages/system/seaweedfs-db/Chart.yaml | 3 ++ packages/system/seaweedfs-db/Makefile | 4 ++ packages/system/seaweedfs-db/README.md | 13 +++++ .../templates/database.yaml | 0 .../system/seaweedfs-db/values.schema.json | 37 +++++++++++++++ packages/system/seaweedfs-db/values.yaml | 18 +++++++ packages/system/seaweedfs/values.yaml | 4 -- 11 files changed, 160 insertions(+), 13 deletions(-) create mode 100755 packages/core/platform/images/migrations/migrations/43 create mode 100644 packages/extra/seaweedfs/templates/seaweedfs-db.yaml create mode 100644 packages/system/seaweedfs-db/Chart.yaml create mode 100644 packages/system/seaweedfs-db/Makefile create mode 100644 packages/system/seaweedfs-db/README.md rename packages/system/{seaweedfs => seaweedfs-db}/templates/database.yaml (100%) create mode 100644 packages/system/seaweedfs-db/values.schema.json create mode 100644 packages/system/seaweedfs-db/values.yaml diff --git a/packages/core/platform/images/migrations/migrations/43 b/packages/core/platform/images/migrations/migrations/43 new file mode 100755 index 000000000..de49359b1 --- /dev/null +++ b/packages/core/platform/images/migrations/migrations/43 @@ -0,0 +1,32 @@ +#!/bin/sh +# Migration 43 --> 44 +# Adopt existing Cluster/seaweedfs-db resources into the new seaweedfs-db +# HelmRelease introduced in this release. +# +# Pre-split, the CNPG Cluster lived inside the seaweedfs-system Helm release. +# Splitting moves it to a new release named seaweedfs-db. We rewrite the +# helm ownership annotations so Helm adopts the existing Cluster instead of +# erroring on the next reconcile, and stamp helm.sh/resource-policy: keep +# so the seaweedfs-system upgrade (which no longer renders the Cluster) does +# not delete it during the transition. + +set -euo pipefail + +# Iterate every namespace that has a Cluster named "seaweedfs-db". +for ns in $(kubectl get cluster.postgresql.cnpg.io -A \ + -o jsonpath='{range .items[?(@.metadata.name=="seaweedfs-db")]}{.metadata.namespace}{"\n"}{end}'); do + current=$(kubectl get cluster.postgresql.cnpg.io seaweedfs-db -n "$ns" \ + -o jsonpath='{.metadata.annotations.meta\.helm\.sh/release-name}' 2>/dev/null || true) + if [ "$current" = "seaweedfs-system" ]; then + echo "Re-annotating Cluster/seaweedfs-db in $ns: seaweedfs-system -> seaweedfs-db" + kubectl annotate cluster.postgresql.cnpg.io seaweedfs-db -n "$ns" \ + meta.helm.sh/release-name=seaweedfs-db \ + helm.sh/resource-policy=keep \ + --overwrite + # release-namespace stays the same (tenant namespace, e.g. tenant-root) + fi +done + +# Stamp version +kubectl create configmap -n cozy-system cozystack-version \ + --from-literal=version=44 --dry-run=client -o yaml | kubectl apply -f- diff --git a/packages/core/platform/sources/seaweedfs-application.yaml b/packages/core/platform/sources/seaweedfs-application.yaml index 70de66624..a213ebc86 100644 --- a/packages/core/platform/sources/seaweedfs-application.yaml +++ b/packages/core/platform/sources/seaweedfs-application.yaml @@ -17,6 +17,8 @@ spec: - name: cozy-lib path: library/cozy-lib components: + - name: seaweedfs-db + path: system/seaweedfs-db - name: seaweedfs-system path: system/seaweedfs - name: seaweedfs diff --git a/packages/extra/seaweedfs/templates/seaweedfs-db.yaml b/packages/extra/seaweedfs/templates/seaweedfs-db.yaml new file mode 100644 index 000000000..c86677c4d --- /dev/null +++ b/packages/extra/seaweedfs/templates/seaweedfs-db.yaml @@ -0,0 +1,47 @@ +{{- if not (eq .Values.topology "Client") }} +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: {{ .Release.Name }}-db + labels: + sharding.fluxcd.io/key: tenants +spec: + chartRef: + kind: ExternalArtifact + name: cozystack-seaweedfs-application-default-seaweedfs-db + namespace: cozy-system + interval: 5m + timeout: 10m + install: + remediation: + retries: -1 + upgrade: + remediation: + retries: -1 + # `poller` waitStrategy is required for healthCheckExprs to be evaluated. + # Without it, the HR flips Ready as soon as helm install applies the Cluster CR, + # before CNPG has bootstrapped postgres. + waitStrategy: + name: poller + # CNPG sets Ready=False with reason=ClusterIsNotReady during normal bootstrap, + # so a plain Ready=False predicate flags the HR failed within seconds. Treat + # the bootstrap reason as in-progress; reserve `failed` for other Ready=False + # reasons CNPG might add in the future. The HR `timeout:` is the real backstop. + healthCheckExprs: + - apiVersion: postgresql.cnpg.io/v1 + kind: Cluster + inProgress: has(status.conditions) && status.conditions.exists(e, e.type == 'Ready' && e.status == 'False' && e.reason == 'ClusterIsNotReady') + failed: has(status.conditions) && status.conditions.exists(e, e.type == 'Ready' && e.status == 'False' && e.reason != 'ClusterIsNotReady') + current: has(status.conditions) && status.conditions.exists(e, e.type == 'Ready' && e.status == 'True') + valuesFrom: + - kind: Secret + name: cozystack-values + values: + db: + replicas: {{ .Values.db.replicas }} + resources: {{- include "cozy-lib.resources.defaultingSanitize" (list .Values.db.resourcesPreset .Values.db.resources $) | nindent 8 }} + size: {{ .Values.db.size }} + {{- with .Values.db.storageClass }} + storageClass: {{ . }} + {{- end }} +{{- end }} diff --git a/packages/extra/seaweedfs/templates/seaweedfs.yaml b/packages/extra/seaweedfs/templates/seaweedfs.yaml index ba7953ee7..80c9b68b5 100644 --- a/packages/extra/seaweedfs/templates/seaweedfs.yaml +++ b/packages/extra/seaweedfs/templates/seaweedfs.yaml @@ -104,12 +104,13 @@ metadata: labels: sharding.fluxcd.io/key: tenants spec: + dependsOn: + - name: {{ .Release.Name }}-db {{- if eq $ingress .Release.Namespace }} # Ensure the ingress-nginx admission webhook is ready before creating Ingress resources. # Only when this tenant owns its ingress; sub-tenants inherit ingress from a parent # namespace where ingress-nginx-system already runs, and the dependency would deadlock # because the HR doesn't exist locally. - dependsOn: - name: ingress-nginx-system namespace: {{ .Release.Namespace }} {{- end }} @@ -117,12 +118,13 @@ spec: kind: ExternalArtifact name: cozystack-seaweedfs-application-default-seaweedfs-system namespace: cozy-system - interval: 5m + interval: 30s timeout: 10m install: remediation: retries: -1 upgrade: + force: true remediation: retries: -1 valuesFrom: @@ -131,13 +133,6 @@ spec: values: global: serviceAccountName: "{{ .Release.Namespace }}-seaweedfs" - db: - replicas: {{ .Values.db.replicas }} - resources: {{- include "cozy-lib.resources.defaultingSanitize" (list .Values.db.resourcesPreset .Values.db.resources $) | nindent 8 }} - size: {{ .Values.db.size }} - {{- with .Values.db.storageClass }} - storageClass: {{ . }} - {{- end }} seaweedfs: master: {{ if eq .Values.topology "Simple" }} diff --git a/packages/system/seaweedfs-db/Chart.yaml b/packages/system/seaweedfs-db/Chart.yaml new file mode 100644 index 000000000..0b0dbbe79 --- /dev/null +++ b/packages/system/seaweedfs-db/Chart.yaml @@ -0,0 +1,3 @@ +apiVersion: v2 +name: cozy-seaweedfs-db +version: 0.0.0 # Placeholder, the actual version will be automatically set during the build process diff --git a/packages/system/seaweedfs-db/Makefile b/packages/system/seaweedfs-db/Makefile new file mode 100644 index 000000000..73eda9d42 --- /dev/null +++ b/packages/system/seaweedfs-db/Makefile @@ -0,0 +1,4 @@ +export NAME=seaweedfs-db + +include ../../../hack/common-envs.mk +include ../../../hack/package.mk diff --git a/packages/system/seaweedfs-db/README.md b/packages/system/seaweedfs-db/README.md new file mode 100644 index 000000000..5b25a5ae5 --- /dev/null +++ b/packages/system/seaweedfs-db/README.md @@ -0,0 +1,13 @@ +# SeaweedFS Database + +## Parameters + +### Database parameters + +| Name | Description | Type | Value | +| ----------------- | ------------------------------------ | ---------- | ------ | +| `db` | Database configuration. | `object` | `{}` | +| `db.replicas` | Number of database replicas. | `int` | `2` | +| `db.size` | Persistent Volume size. | `quantity` | `10Gi` | +| `db.storageClass` | StorageClass used to store the data. | `string` | `""` | + diff --git a/packages/system/seaweedfs/templates/database.yaml b/packages/system/seaweedfs-db/templates/database.yaml similarity index 100% rename from packages/system/seaweedfs/templates/database.yaml rename to packages/system/seaweedfs-db/templates/database.yaml diff --git a/packages/system/seaweedfs-db/values.schema.json b/packages/system/seaweedfs-db/values.schema.json new file mode 100644 index 000000000..5c9beb532 --- /dev/null +++ b/packages/system/seaweedfs-db/values.schema.json @@ -0,0 +1,37 @@ +{ + "title": "Chart Values", + "type": "object", + "properties": { + "db": { + "description": "Database configuration.", + "type": "object", + "default": {}, + "properties": { + "replicas": { + "description": "Number of database replicas.", + "type": "integer", + "default": 2 + }, + "size": { + "description": "Persistent Volume size.", + "default": "10Gi", + "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "anyOf": [ + { + "type": "integer" + }, + { + "type": "string" + } + ], + "x-kubernetes-int-or-string": true + }, + "storageClass": { + "description": "StorageClass used to store the data.", + "type": "string", + "default": "" + } + } + } + } +} diff --git a/packages/system/seaweedfs-db/values.yaml b/packages/system/seaweedfs-db/values.yaml new file mode 100644 index 000000000..5f59c7a1b --- /dev/null +++ b/packages/system/seaweedfs-db/values.yaml @@ -0,0 +1,18 @@ +## +## @section Database parameters +## + +## @typedef {struct} Resources - Resource configuration. +## @field {quantity} [cpu] - Number of CPU cores allocated. +## @field {quantity} [memory] - Amount of memory allocated. + +## @typedef {struct} DB - Database configuration. +## @field {int} [replicas] - Number of database replicas. +## @field {quantity} [size] - Persistent Volume size. +## @field {string} [storageClass] - StorageClass used to store the data. + +## @param {DB} db - Database configuration. +db: + replicas: 2 + size: 10Gi + storageClass: "" diff --git a/packages/system/seaweedfs/values.yaml b/packages/system/seaweedfs/values.yaml index 8f9920a97..f7a6ac7e7 100644 --- a/packages/system/seaweedfs/values.yaml +++ b/packages/system/seaweedfs/values.yaml @@ -188,7 +188,3 @@ seaweedfs: keySize: 2048 duration: 87600h # 10 years renewBefore: 720h # 30d -db: - replicas: 2 - size: 10Gi - storageClass: "" From dccdeb5229150f6795e2b5d767fabe9956a5fe6c Mon Sep 17 00:00:00 2001 From: Myasnikov Daniil Date: Thu, 14 May 2026 09:13:44 +0500 Subject: [PATCH 13/28] fix(tenant): bump parent HR timeout to 15m to cover seaweedfs split PR #2619 split seaweedfs into a serialized chain (seaweedfs-db -> seaweedfs-system -> seaweedfs) that needs ~5 min of wall-clock to install: CNPG bootstrap, master quorum, then the wrapper. With the prior 5m wait budget on the parent tenant HR, helm-controller would time out before the children reach Ready, rollback would delete the child HRs, and the upgrade would retry in a loop. The e2e bats step that patches the Tenant CR and waits 60s for child HRs to exist landed in the rollback gap and timed out. Two complementary changes: - tenant-root is created statically by cozystack-basics, so its HelmRelease spec.timeout is bumped 5m -> 15m directly. - Sub-tenants (Tenant CRs) get their HR built by cozystack-api from the tenant ApplicationDefinition. Add the release.cozystack.io/helm-install-timeout=15m annotation that kubernetes-rd already uses to opt the kind into the longer budget. Keeps both values in lockstep and documents the coupling inline. Assisted-By: Claude Signed-off-by: Myasnikov Daniil (cherry picked from commit cc9da3a80a7585ca53d0cc2787b6003ed542d20a) --- .../cozystack-basics/templates/tenant-root.yaml | 2 +- packages/system/tenant-rd/cozyrds/tenant.yaml | 13 +++++++++++++ 2 files changed, 14 insertions(+), 1 deletion(-) diff --git a/packages/system/cozystack-basics/templates/tenant-root.yaml b/packages/system/cozystack-basics/templates/tenant-root.yaml index c7b6ba111..43ba23fbc 100644 --- a/packages/system/cozystack-basics/templates/tenant-root.yaml +++ b/packages/system/cozystack-basics/templates/tenant-root.yaml @@ -37,7 +37,7 @@ spec: name: cozystack-tenant-application-default-tenant namespace: cozy-system interval: 1m0s - timeout: 5m0s + timeout: 15m0s valuesFrom: - kind: Secret name: cozystack-values diff --git a/packages/system/tenant-rd/cozyrds/tenant.yaml b/packages/system/tenant-rd/cozyrds/tenant.yaml index 5fd6643b8..e6532ef79 100644 --- a/packages/system/tenant-rd/cozyrds/tenant.yaml +++ b/packages/system/tenant-rd/cozyrds/tenant.yaml @@ -2,6 +2,19 @@ apiVersion: cozystack.io/v1alpha1 kind: ApplicationDefinition metadata: name: tenant + annotations: + # Tenant charts install a serial chain of child HelmReleases (seaweedfs, + # monitoring, etcd, ingress). The seaweedfs subtree alone is now + # seaweedfs-db -> seaweedfs-system -> seaweedfs (~5 min wall-clock for + # CNPG bootstrap + master quorum). Flux helm-controller's default 5m + # wait budget on the parent tenant HR fires before children reach Ready, + # which rolls back the children and starts an oscillation loop. This + # override is applied by cozystack-api to the HelmRelease + # Spec.Install.Timeout and Spec.Upgrade.Timeout for sub-tenants. + # tenant-root uses a static HR defined in + # packages/system/cozystack-basics/templates/tenant-root.yaml; its + # timeout is set there directly. Keep the two values aligned. + release.cozystack.io/helm-install-timeout: "15m" spec: application: kind: Tenant From 7157158c937e331dee48dfd9ee5edd61ff6c4c3a Mon Sep 17 00:00:00 2001 From: Myasnikov Daniil Date: Tue, 26 May 2026 01:01:57 +0500 Subject: [PATCH 14/28] fix(seaweedfs-db): make db resources configurable values.yaml declared an unused Resources typedef while templates/database.yaml hardcoded cpu/memory limits and requests. The wrapper chart at packages/extra/seaweedfs/templates/seaweedfs-db.yaml already passes db.resources through cozy-lib.resources.defaultingSanitize into the sub-chart values, so the user-facing db.resources and db.resourcesPreset on the outer chart silently dropped on the way in. Drop the unused typedef, accept .Values.db.resources as a free-form object (the wrapper already sanitizes it into the K8s nested limits/requests shape that CNPG Cluster expects), and wire it through to the Cluster manifest. Defaults are preserved verbatim so helm template output is byte-identical for a no-override install. Assisted-By: Claude Signed-off-by: Myasnikov Daniil --- packages/system/seaweedfs-db/README.md | 13 +++++++------ .../system/seaweedfs-db/templates/database.yaml | 7 +------ packages/system/seaweedfs-db/values.schema.json | 15 +++++++++++++++ packages/system/seaweedfs-db/values.yaml | 12 ++++++++---- 4 files changed, 31 insertions(+), 16 deletions(-) diff --git a/packages/system/seaweedfs-db/README.md b/packages/system/seaweedfs-db/README.md index 5b25a5ae5..70566913a 100644 --- a/packages/system/seaweedfs-db/README.md +++ b/packages/system/seaweedfs-db/README.md @@ -4,10 +4,11 @@ ### Database parameters -| Name | Description | Type | Value | -| ----------------- | ------------------------------------ | ---------- | ------ | -| `db` | Database configuration. | `object` | `{}` | -| `db.replicas` | Number of database replicas. | `int` | `2` | -| `db.size` | Persistent Volume size. | `quantity` | `10Gi` | -| `db.storageClass` | StorageClass used to store the data. | `string` | `""` | +| Name | Description | Type | Value | +| ----------------- | ----------------------------------------------------------------------------- | ---------- | ------------------------------------------------------------------------------------- | +| `db` | Database configuration. | `object` | `{}` | +| `db.replicas` | Number of database replicas. | `int` | `2` | +| `db.size` | Persistent Volume size. | `quantity` | `10Gi` | +| `db.storageClass` | StorageClass used to store the data. | `string` | `""` | +| `db.resources` | Kubernetes resource requests and limits, passed verbatim to the CNPG Cluster. | `object` | `{"limits":{"cpu":"1","memory":"2048Mi"},"requests":{"cpu":"100m","memory":"512Mi"}}` | diff --git a/packages/system/seaweedfs-db/templates/database.yaml b/packages/system/seaweedfs-db/templates/database.yaml index b9b50c49e..807bd13af 100644 --- a/packages/system/seaweedfs-db/templates/database.yaml +++ b/packages/system/seaweedfs-db/templates/database.yaml @@ -17,12 +17,7 @@ spec: monitoring: enablePodMonitor: true resources: - limits: - cpu: "1" - memory: 2048Mi - requests: - cpu: 100m - memory: 512Mi + {{- toYaml .Values.db.resources | nindent 4 }} inheritedMetadata: labels: policy.cozystack.io/allow-to-apiserver: "true" diff --git a/packages/system/seaweedfs-db/values.schema.json b/packages/system/seaweedfs-db/values.schema.json index 5c9beb532..5cc1dea8d 100644 --- a/packages/system/seaweedfs-db/values.schema.json +++ b/packages/system/seaweedfs-db/values.schema.json @@ -12,6 +12,21 @@ "type": "integer", "default": 2 }, + "resources": { + "description": "Kubernetes resource requests and limits, passed verbatim to the CNPG Cluster.", + "type": "object", + "default": { + "limits": { + "cpu": "1", + "memory": "2048Mi" + }, + "requests": { + "cpu": "100m", + "memory": "512Mi" + } + }, + "x-kubernetes-preserve-unknown-fields": true + }, "size": { "description": "Persistent Volume size.", "default": "10Gi", diff --git a/packages/system/seaweedfs-db/values.yaml b/packages/system/seaweedfs-db/values.yaml index 5f59c7a1b..3a610065b 100644 --- a/packages/system/seaweedfs-db/values.yaml +++ b/packages/system/seaweedfs-db/values.yaml @@ -2,17 +2,21 @@ ## @section Database parameters ## -## @typedef {struct} Resources - Resource configuration. -## @field {quantity} [cpu] - Number of CPU cores allocated. -## @field {quantity} [memory] - Amount of memory allocated. - ## @typedef {struct} DB - Database configuration. ## @field {int} [replicas] - Number of database replicas. ## @field {quantity} [size] - Persistent Volume size. ## @field {string} [storageClass] - StorageClass used to store the data. +## @field {object} [resources] - Kubernetes resource requests and limits, passed verbatim to the CNPG Cluster. ## @param {DB} db - Database configuration. db: replicas: 2 size: 10Gi storageClass: "" + resources: + limits: + cpu: "1" + memory: 2048Mi + requests: + cpu: 100m + memory: 512Mi From 3fe74ba68eda31c693d5988be173e30090b8444e Mon Sep 17 00:00:00 2001 From: Myasnikov Daniil Date: Thu, 28 May 2026 16:46:15 +0500 Subject: [PATCH 15/28] fix(seaweedfs): drop deprecated upgrade.force from seaweedfs-system HR The flux-bump-v048 base branch removed upgrade.force from every other HelmRelease in 7f94182a87 because helm-controller v0.48 refuses to combine Helm's --force replace with server-side apply's --force-conflicts ("cannot use force conflicts and force replace together"). This refactor re-introduced the field on the seaweedfs-system HR by accident; CI E2E fails with the same error in a loop until the seaweedfs subtree times out the tenant install. Drop the line so the upgrade path matches every other HR on the base branch. Signed-off-by: Myasnikov Daniil --- packages/extra/seaweedfs/templates/seaweedfs.yaml | 1 - 1 file changed, 1 deletion(-) diff --git a/packages/extra/seaweedfs/templates/seaweedfs.yaml b/packages/extra/seaweedfs/templates/seaweedfs.yaml index 80c9b68b5..1e30df3d4 100644 --- a/packages/extra/seaweedfs/templates/seaweedfs.yaml +++ b/packages/extra/seaweedfs/templates/seaweedfs.yaml @@ -124,7 +124,6 @@ spec: remediation: retries: -1 upgrade: - force: true remediation: retries: -1 valuesFrom: From d0480f4561f1c4067becf8a5ae32066860f63e98 Mon Sep 17 00:00:00 2001 From: Myasnikov Daniil Date: Thu, 28 May 2026 21:24:14 +0500 Subject: [PATCH 16/28] fix(fluxcd): suppress upstream web NetworkPolicy in flux-operator The vendored flux-operator chart ships a NetworkPolicy on port 9080 gated by web.enabled + web.networkPolicy.create (default true). Cozystack already restricts ports 8080/8081/9080 via a CiliumClusterwideNetworkPolicy patched into the same chart, so the upstream policy is redundant if a user opts in to web.enabled: true. Pin networkPolicy.create to false to keep the Cilium policy as the single source of truth. Assisted-By: Claude Signed-off-by: Myasnikov Daniil --- packages/system/fluxcd-operator/values.yaml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/packages/system/fluxcd-operator/values.yaml b/packages/system/fluxcd-operator/values.yaml index 793fea333..28a5f6132 100644 --- a/packages/system/fluxcd-operator/values.yaml +++ b/packages/system/fluxcd-operator/values.yaml @@ -14,5 +14,9 @@ flux-operator: memory: 350Mi # Flux Status Web UI is opt-in. Override `web.enabled: true` (and configure # `web.config` / `web.configSecretName` / `web.ingress` as needed) to enable. + # The upstream chart's NetworkPolicy is suppressed because Cozystack ships a + # CiliumClusterwideNetworkPolicy that already restricts ports 8080/8081/9080. web: enabled: false + networkPolicy: + create: false From a3a7a6d516c724b45f969750770282a2245ab794 Mon Sep 17 00:00:00 2001 From: Myasnikov Daniil Date: Thu, 28 May 2026 21:25:25 +0500 Subject: [PATCH 17/28] test(e2e): add HR existence backstop for external-dns ${name}-system The two external-dns bats tests already poll for the user-facing ${name} HelmRelease before calling kubectl wait, but they immediately wait on the ${name}-system HR without the same backstop. The system HR is materialised asynchronously by the controller, so kubectl wait can race and exit non-zero when the object does not exist yet. Apply the same existence poll pattern to both occurrences. Assisted-By: Claude Signed-off-by: Myasnikov Daniil --- hack/e2e-apps/external-dns.bats | 2 ++ 1 file changed, 2 insertions(+) diff --git a/hack/e2e-apps/external-dns.bats b/hack/e2e-apps/external-dns.bats index b1bc71a57..23b3e8cf6 100644 --- a/hack/e2e-apps/external-dns.bats +++ b/hack/e2e-apps/external-dns.bats @@ -22,6 +22,7 @@ EOF # kicks in (kubectl wait errors immediately if the object does not exist yet). timeout 60 sh -ec "until kubectl -n tenant-test get hr ${name} >/dev/null 2>&1; do sleep 2; done" kubectl -n tenant-test wait hr ${name} --timeout=5m --for=condition=ready + timeout 60 sh -ec "until kubectl -n tenant-test get hr ${name}-system >/dev/null 2>&1; do sleep 2; done" kubectl -n tenant-test wait hr ${name}-system --timeout=5m --for=condition=ready timeout 60 sh -ec "until kubectl -n tenant-test get deploy -l app.kubernetes.io/instance=${name}-system -o jsonpath='{.items[0].status.readyReplicas}' | grep -q '1'; do sleep 5; done" @@ -47,6 +48,7 @@ EOF # kicks in (kubectl wait errors immediately if the object does not exist yet). timeout 60 sh -ec "until kubectl -n tenant-test get hr ${name} >/dev/null 2>&1; do sleep 2; done" kubectl -n tenant-test wait hr ${name} --timeout=5m --for=condition=ready + timeout 60 sh -ec "until kubectl -n tenant-test get hr ${name}-system >/dev/null 2>&1; do sleep 2; done" kubectl -n tenant-test wait hr ${name}-system --timeout=5m --for=condition=ready timeout 60 sh -ec "until kubectl -n tenant-test get deploy -l app.kubernetes.io/instance=${name}-system -o jsonpath='{.items[0].status.readyReplicas}' | grep -q '1'; do sleep 5; done" From f880b3249564df5ef8d3406eb7e87be047e25f6d Mon Sep 17 00:00:00 2001 From: Myasnikov Daniil Date: Sun, 31 May 2026 15:02:01 +0500 Subject: [PATCH 18/28] fix(platform): bump migrations targetVersion to 44 so seaweedfs-db adoption runs MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit run-migrations.sh loops `seq $CURRENT $((TARGET-1))`, so with targetVersion: 43 a cluster at version 42 runs only migration 42 — migration 43 (the seaweedfs-db Cluster adoption introduced by the split) is never iterated, and the missing-file guard never fires because 43 is out of range. The migration is written as "43 -> 44" and stamps version=44. Without it the new seaweedfs-db HelmRelease hits a Helm ownership conflict on the existing Cluster and the seaweedfs-system upgrade can prune it (filer metadata loss). Set targetVersion to 44 so migration 43 runs, matching the migration-42 precedent. Assisted-By: Claude Signed-off-by: Myasnikov Daniil --- packages/core/platform/values.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/packages/core/platform/values.yaml b/packages/core/platform/values.yaml index 9590049b0..02fb3bd62 100644 --- a/packages/core/platform/values.yaml +++ b/packages/core/platform/values.yaml @@ -6,7 +6,7 @@ sourceRef: migrations: enabled: false image: ghcr.io/cozystack/cozystack/platform-migrations:v1.4.0-rc.2@sha256:17390197a9b11d76a8dd1b24c6d1512adb7d3226b28b5bcba8551b14b1ec4be0 - targetVersion: 43 + targetVersion: 44 # Bundle deployment configuration bundles: system: From e3f4e34a0badaf276892d36a624c4e49fe6a743e Mon Sep 17 00:00:00 2001 From: Myasnikov Daniil Date: Sun, 31 May 2026 15:02:11 +0500 Subject: [PATCH 19/28] fix(tenant): drop deprecated upgrade.force from gateway HelmRelease The flux-v2.8 sweep removed `upgrade.force: true` from the sibling tenant HelmReleases (etcd, info, ingress, monitoring, seaweedfs) for helm-controller v1.5 SSA compatibility, but gateway.yaml was missed. Complete the sweep so no tenant HR keeps the flag that conflicts with Server-Side Apply. Assisted-By: Claude Signed-off-by: Myasnikov Daniil --- packages/apps/tenant/templates/gateway.yaml | 1 - 1 file changed, 1 deletion(-) diff --git a/packages/apps/tenant/templates/gateway.yaml b/packages/apps/tenant/templates/gateway.yaml index 6e6d2ee0a..afb539811 100644 --- a/packages/apps/tenant/templates/gateway.yaml +++ b/packages/apps/tenant/templates/gateway.yaml @@ -23,7 +23,6 @@ spec: remediation: retries: -1 upgrade: - force: true remediation: retries: -1 valuesFrom: From 2a6112bdc7a71fcf6666aac6e5259778b4ab180e Mon Sep 17 00:00:00 2001 From: Myasnikov Daniil Date: Sun, 31 May 2026 15:02:12 +0500 Subject: [PATCH 20/28] fix(foundationdb): default imageType to split to keep upgrades non-disruptive Pre-SSA the chart nested imageType under automationOptions, where Flux v2.7 silently dropped it, so the operator always used its own default (split). Flux v2.8 SSA now delivers the field, so the chart's previous "unified" default would trigger an in-place image-type migration on the first upgrade of every existing cluster. Default to "split" to match the value clusters effectively ran; operators can set "unified" to migrate deliberately. Assisted-By: Claude Signed-off-by: Myasnikov Daniil --- packages/apps/foundationdb/README.md | 6 +++--- packages/apps/foundationdb/values.schema.json | 2 +- packages/apps/foundationdb/values.yaml | 9 +++++++-- .../system/foundationdb-rd/cozyrds/foundationdb.yaml | 2 +- 4 files changed, 12 insertions(+), 7 deletions(-) diff --git a/packages/apps/foundationdb/README.md b/packages/apps/foundationdb/README.md index df971d299..5ee45b65e 100644 --- a/packages/apps/foundationdb/README.md +++ b/packages/apps/foundationdb/README.md @@ -81,8 +81,8 @@ when it sees a chart-rendered Running backup against the same target. customParameters: - "knob_disable_posix_kernel_aio=1" -# Image type (unified is default and recommended for new deployments) -imageType: "unified" +# Image type (split is the default; matches existing clusters' effective value) +imageType: "split" # Enable automatic pod replacements automaticReplacements: true @@ -194,7 +194,7 @@ For Cozystack-specific issues, consult the Cozystack documentation or support ch | Name | Description | Type | Value | | ---------------------------- | ------------------------------------------ | ---------- | --------- | | `customParameters` | Custom parameters to pass to FoundationDB. | `[]string` | `[]` | -| `imageType` | Container image deployment type. | `string` | `unified` | +| `imageType` | Container image deployment type. | `string` | `split` | | `securityContext` | Security context for containers. | `object` | `{}` | | `securityContext.runAsUser` | User ID to run the container. | `int` | `4059` | | `securityContext.runAsGroup` | Group ID to run the container. | `int` | `4059` | diff --git a/packages/apps/foundationdb/values.schema.json b/packages/apps/foundationdb/values.schema.json index 0df77b498..35c60fa35 100644 --- a/packages/apps/foundationdb/values.schema.json +++ b/packages/apps/foundationdb/values.schema.json @@ -299,7 +299,7 @@ "imageType": { "description": "Container image deployment type.", "type": "string", - "default": "unified", + "default": "split", "enum": [ "unified", "split" diff --git a/packages/apps/foundationdb/values.yaml b/packages/apps/foundationdb/values.yaml index 3c0626302..a1c62a948 100644 --- a/packages/apps/foundationdb/values.yaml +++ b/packages/apps/foundationdb/values.yaml @@ -147,8 +147,13 @@ customParameters: [] ## @value unified ## @value split -## @param {ImageType} imageType="unified" - Container image deployment type. -imageType: "unified" +## @param {ImageType} imageType="split" - Container image deployment type. +# Defaults to "split" to match the operator default that existing clusters +# already run: before the Flux v2.8 SSA fix this value was nested under +# automationOptions and silently dropped, so the operator never saw "unified". +# Setting it to "split" keeps upgrades non-disruptive; switch to "unified" +# deliberately to migrate (triggers an in-place image-type change). +imageType: "split" ## @typedef {struct} SecurityContext - Security context for containers. ## @field {int} runAsUser - User ID to run the container. diff --git a/packages/system/foundationdb-rd/cozyrds/foundationdb.yaml b/packages/system/foundationdb-rd/cozyrds/foundationdb.yaml index 6ef66c3dc..de1042645 100644 --- a/packages/system/foundationdb-rd/cozyrds/foundationdb.yaml +++ b/packages/system/foundationdb-rd/cozyrds/foundationdb.yaml @@ -8,7 +8,7 @@ spec: singular: foundationdb plural: foundationdbs openAPISchema: |- - {"title":"Chart Values","type":"object","properties":{"cluster":{"description":"Cluster configuration.","type":"object","default":{},"required":["faultDomain","processCounts","redundancyMode","storageEngine","version"],"properties":{"faultDomain":{"description":"Fault domain configuration.","type":"object","default":{},"required":["key","valueFrom"],"properties":{"key":{"description":"Fault domain key.","type":"string","default":"kubernetes.io/hostname"},"valueFrom":{"description":"Fault domain value source.","type":"string","default":"spec.nodeName"}}},"processCounts":{"description":"Process counts for different roles.","type":"object","default":{},"required":["cluster_controller","stateless","storage"],"properties":{"cluster_controller":{"description":"Number of cluster controller processes.","type":"integer","default":1},"stateless":{"description":"Number of stateless processes (-1 for automatic).","type":"integer","default":-1},"storage":{"description":"Number of storage processes (determines cluster size).","type":"integer","default":3}}},"redundancyMode":{"description":"Database redundancy mode (single, double, triple, three_datacenter, three_datacenter_fallback).","type":"string","default":"double"},"storageEngine":{"description":"Storage engine (ssd-2, ssd-redwood-v1, ssd-rocksdb-v1, memory).","type":"string","default":"ssd-2"},"version":{"description":"Version of FoundationDB to use.","type":"string","default":"7.3.63"}}},"storage":{"description":"Storage configuration.","type":"object","default":{},"required":["size","storageClass"],"properties":{"size":{"description":"Size of persistent volumes for each instance.","default":"16Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"storageClass":{"description":"Storage class (if not set, uses cluster default).","type":"string","default":"","x-kubernetes-validations":[{"rule":"self == oldSelf","message":"storageClass is immutable"}]}}},"resources":{"description":"Explicit CPU and memory configuration for each FoundationDB instance. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available to each instance.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available to each instance.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"c1.small","enum":["t1.nano","t1.micro","t1.small","t1.medium","t1.large","t1.xlarge","t1.2xlarge","t1.4xlarge","c1.nano","c1.micro","c1.small","c1.medium","c1.large","c1.xlarge","c1.2xlarge","c1.4xlarge","s1.nano","s1.micro","s1.small","s1.medium","s1.large","s1.xlarge","s1.2xlarge","s1.4xlarge","u1.nano","u1.micro","u1.small","u1.medium","u1.large","u1.xlarge","u1.2xlarge","u1.4xlarge","m1.nano","m1.micro","m1.small","m1.medium","m1.large","m1.xlarge","m1.2xlarge","m1.4xlarge","nano","micro","small","medium","large","xlarge","2xlarge"]},"backup":{"description":"DEPRECATED Backup configuration (use the Cozystack backups framework: BackupClass + FoundationDB strategy).","type":"object","default":{},"required":["enabled","retentionPolicy","s3"],"properties":{"enabled":{"description":"DEPRECATED Enable in-chart backups (superseded by BackupClass + FoundationDB strategy).","type":"boolean","default":false},"retentionPolicy":{"description":"DEPRECATED Retention policy for backups.","type":"string","default":"7d"},"s3":{"description":"DEPRECATED S3 configuration for backups.","type":"object","default":{},"required":["bucket","credentials","endpoint","region"],"properties":{"bucket":{"description":"DEPRECATED S3 bucket name.","type":"string","default":""},"credentials":{"description":"DEPRECATED S3 credentials.","type":"object","default":{},"required":["accessKeyId","secretAccessKey"],"properties":{"accessKeyId":{"description":"DEPRECATED S3 access key ID.","type":"string","default":""},"secretAccessKey":{"description":"DEPRECATED S3 secret access key.","type":"string","default":""}}},"endpoint":{"description":"DEPRECATED S3 endpoint URL.","type":"string","default":""},"region":{"description":"DEPRECATED S3 region.","type":"string","default":"us-east-1"}}}}},"monitoring":{"description":"Monitoring configuration.","type":"object","default":{},"required":["enabled"],"properties":{"enabled":{"description":"Enable WorkloadMonitor integration.","type":"boolean","default":true}}},"customParameters":{"description":"Custom parameters to pass to FoundationDB.","type":"array","default":[],"items":{"type":"string"}},"imageType":{"description":"Container image deployment type.","type":"string","default":"unified","enum":["unified","split"]},"securityContext":{"description":"Security context for containers.","type":"object","default":{},"required":["runAsGroup","runAsUser"],"properties":{"runAsGroup":{"description":"Group ID to run the container.","type":"integer","default":4059},"runAsUser":{"description":"User ID to run the container.","type":"integer","default":4059}}},"automaticReplacements":{"description":"Enable automatic pod replacements.","type":"boolean","default":true}}} + {"title":"Chart Values","type":"object","properties":{"cluster":{"description":"Cluster configuration.","type":"object","default":{},"required":["faultDomain","processCounts","redundancyMode","storageEngine","version"],"properties":{"faultDomain":{"description":"Fault domain configuration.","type":"object","default":{},"required":["key","valueFrom"],"properties":{"key":{"description":"Fault domain key.","type":"string","default":"kubernetes.io/hostname"},"valueFrom":{"description":"Fault domain value source.","type":"string","default":"spec.nodeName"}}},"processCounts":{"description":"Process counts for different roles.","type":"object","default":{},"required":["cluster_controller","stateless","storage"],"properties":{"cluster_controller":{"description":"Number of cluster controller processes.","type":"integer","default":1},"stateless":{"description":"Number of stateless processes (-1 for automatic).","type":"integer","default":-1},"storage":{"description":"Number of storage processes (determines cluster size).","type":"integer","default":3}}},"redundancyMode":{"description":"Database redundancy mode (single, double, triple, three_datacenter, three_datacenter_fallback).","type":"string","default":"double"},"storageEngine":{"description":"Storage engine (ssd-2, ssd-redwood-v1, ssd-rocksdb-v1, memory).","type":"string","default":"ssd-2"},"version":{"description":"Version of FoundationDB to use.","type":"string","default":"7.3.63"}}},"storage":{"description":"Storage configuration.","type":"object","default":{},"required":["size","storageClass"],"properties":{"size":{"description":"Size of persistent volumes for each instance.","default":"16Gi","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"storageClass":{"description":"Storage class (if not set, uses cluster default).","type":"string","default":"","x-kubernetes-validations":[{"rule":"self == oldSelf","message":"storageClass is immutable"}]}}},"resources":{"description":"Explicit CPU and memory configuration for each FoundationDB instance. When omitted, the preset defined in `resourcesPreset` is applied.","type":"object","default":{},"properties":{"cpu":{"description":"CPU available to each instance.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Memory (RAM) available to each instance.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"resourcesPreset":{"description":"Default sizing preset used when `resources` is omitted.","type":"string","default":"c1.small","enum":["t1.nano","t1.micro","t1.small","t1.medium","t1.large","t1.xlarge","t1.2xlarge","t1.4xlarge","c1.nano","c1.micro","c1.small","c1.medium","c1.large","c1.xlarge","c1.2xlarge","c1.4xlarge","s1.nano","s1.micro","s1.small","s1.medium","s1.large","s1.xlarge","s1.2xlarge","s1.4xlarge","u1.nano","u1.micro","u1.small","u1.medium","u1.large","u1.xlarge","u1.2xlarge","u1.4xlarge","m1.nano","m1.micro","m1.small","m1.medium","m1.large","m1.xlarge","m1.2xlarge","m1.4xlarge","nano","micro","small","medium","large","xlarge","2xlarge"]},"backup":{"description":"DEPRECATED Backup configuration (use the Cozystack backups framework: BackupClass + FoundationDB strategy).","type":"object","default":{},"required":["enabled","retentionPolicy","s3"],"properties":{"enabled":{"description":"DEPRECATED Enable in-chart backups (superseded by BackupClass + FoundationDB strategy).","type":"boolean","default":false},"retentionPolicy":{"description":"DEPRECATED Retention policy for backups.","type":"string","default":"7d"},"s3":{"description":"DEPRECATED S3 configuration for backups.","type":"object","default":{},"required":["bucket","credentials","endpoint","region"],"properties":{"bucket":{"description":"DEPRECATED S3 bucket name.","type":"string","default":""},"credentials":{"description":"DEPRECATED S3 credentials.","type":"object","default":{},"required":["accessKeyId","secretAccessKey"],"properties":{"accessKeyId":{"description":"DEPRECATED S3 access key ID.","type":"string","default":""},"secretAccessKey":{"description":"DEPRECATED S3 secret access key.","type":"string","default":""}}},"endpoint":{"description":"DEPRECATED S3 endpoint URL.","type":"string","default":""},"region":{"description":"DEPRECATED S3 region.","type":"string","default":"us-east-1"}}}}},"monitoring":{"description":"Monitoring configuration.","type":"object","default":{},"required":["enabled"],"properties":{"enabled":{"description":"Enable WorkloadMonitor integration.","type":"boolean","default":true}}},"customParameters":{"description":"Custom parameters to pass to FoundationDB.","type":"array","default":[],"items":{"type":"string"}},"imageType":{"description":"Container image deployment type.","type":"string","default":"split","enum":["unified","split"]},"securityContext":{"description":"Security context for containers.","type":"object","default":{},"required":["runAsGroup","runAsUser"],"properties":{"runAsGroup":{"description":"Group ID to run the container.","type":"integer","default":4059},"runAsUser":{"description":"User ID to run the container.","type":"integer","default":4059}}},"automaticReplacements":{"description":"Enable automatic pod replacements.","type":"boolean","default":true}}} release: prefix: foundationdb- labels: From 9cda93d710a42c3d7ecf3ae1747c5e9ec1400abc Mon Sep 17 00:00:00 2001 From: Myasnikov Daniil Date: Sun, 31 May 2026 15:02:24 +0500 Subject: [PATCH 21/28] fix(kubevirt-instancetypes): pin common-instancetypes and retain gn1 GPU types MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Building from unpinned common-instancetypes HEAD on every `make update` silently churns the catalog. Worse, the v1.3.0 upstream removal dropped the gn1.* (GPU NVIDIA) instancetypes that existing GPU VMs and tenant Kubernetes GPU workers still reference — vm-instance/templates/vm.yaml hard-fails the render when a referenced instancetype is absent. Pin the source to a commit SHA (not a tag: the multi-arch preferredArchitecture fields exist only on main past v1.6.0, so a tag would regress them) and re-append the gn1.* objects from a Cozystack-local extra-instancetypes.yaml the regen copies into templates/. The EOL centos.7*/centos.stream8* preferences stay dropped (release-noted). Regenerate the vm-instance and kubernetes README instancetype/preference tables to match the shipped catalog. Assisted-By: Claude Signed-off-by: Myasnikov Daniil --- packages/apps/kubernetes/README.md | 121 ++++++++------ packages/apps/vm-instance/README.md | 47 +++++- .../system/kubevirt-instancetypes/Makefile | 15 +- .../extra-instancetypes.yaml | 153 ++++++++++++++++++ .../templates/extra-instancetypes.yaml | 153 ++++++++++++++++++ 5 files changed, 430 insertions(+), 59 deletions(-) create mode 100644 packages/system/kubevirt-instancetypes/extra-instancetypes.yaml create mode 100644 packages/system/kubevirt-instancetypes/templates/extra-instancetypes.yaml diff --git a/packages/apps/kubernetes/README.md b/packages/apps/kubernetes/README.md index d6560d6a8..1912419f0 100644 --- a/packages/apps/kubernetes/README.md +++ b/packages/apps/kubernetes/README.md @@ -221,56 +221,77 @@ See [`docs/operations/resource-presets.md`](../../../docs/operations/resource-pr The following instanceType resources are provided by Cozystack: -| Name | vCPUs | Memory | -|---------------|-------|--------| -| `cx1.2xlarge` | 8 | 16Gi | -| `cx1.4xlarge` | 16 | 32Gi | -| `cx1.8xlarge` | 32 | 64Gi | -| `cx1.large` | 2 | 4Gi | -| `cx1.medium` | 1 | 2Gi | -| `cx1.xlarge` | 4 | 8Gi | -| `gn1.2xlarge` | 8 | 32Gi | -| `gn1.4xlarge` | 16 | 64Gi | -| `gn1.8xlarge` | 32 | 128Gi | -| `gn1.xlarge` | 4 | 16Gi | -| `m1.2xlarge` | 8 | 64Gi | -| `m1.4xlarge` | 16 | 128Gi | -| `m1.8xlarge` | 32 | 256Gi | -| `m1.large` | 2 | 16Gi | -| `m1.xlarge` | 4 | 32Gi | -| `n1.2xlarge` | 16 | 32Gi | -| `n1.4xlarge` | 32 | 64Gi | -| `n1.8xlarge` | 64 | 128Gi | -| `n1.large` | 4 | 8Gi | -| `n1.medium` | 4 | 4Gi | -| `n1.xlarge` | 8 | 16Gi | -| `o1.2xlarge` | 8 | 32Gi | -| `o1.4xlarge` | 16 | 64Gi | -| `o1.8xlarge` | 32 | 128Gi | -| `o1.large` | 2 | 8Gi | -| `o1.medium` | 1 | 4Gi | -| `o1.micro` | 1 | 1Gi | -| `o1.nano` | 1 | 512Mi | -| `o1.small` | 1 | 2Gi | -| `o1.xlarge` | 4 | 16Gi | -| `rt1.2xlarge` | 8 | 32Gi | -| `rt1.4xlarge` | 16 | 64Gi | -| `rt1.8xlarge` | 32 | 128Gi | -| `rt1.large` | 2 | 8Gi | -| `rt1.medium` | 1 | 4Gi | -| `rt1.micro` | 1 | 1Gi | -| `rt1.small` | 1 | 2Gi | -| `rt1.xlarge` | 4 | 16Gi | -| `u1.2xlarge` | 8 | 32Gi | -| `u1.2xmedium` | 2 | 4Gi | -| `u1.4xlarge` | 16 | 64Gi | -| `u1.8xlarge` | 32 | 128Gi | -| `u1.large` | 2 | 8Gi | -| `u1.medium` | 1 | 4Gi | -| `u1.micro` | 1 | 1Gi | -| `u1.nano` | 1 | 512Mi | -| `u1.small` | 1 | 2Gi | -| `u1.xlarge` | 4 | 16Gi | +| Name | vCPUs | Memory | +|------------------|-------|--------| +| `cx1.2xlarge` | 8 | 16Gi | +| `cx1.2xlarge1gi` | 8 | 16Gi | +| `cx1.4xlarge` | 16 | 32Gi | +| `cx1.4xlarge1gi` | 16 | 32Gi | +| `cx1.8xlarge` | 32 | 64Gi | +| `cx1.8xlarge1gi` | 32 | 64Gi | +| `cx1.large` | 2 | 4Gi | +| `cx1.large1gi` | 2 | 4Gi | +| `cx1.medium` | 1 | 2Gi | +| `cx1.medium1gi` | 1 | 2Gi | +| `cx1.xlarge` | 4 | 8Gi | +| `cx1.xlarge1gi` | 4 | 8Gi | +| `d1.2xlarge` | 8 | 32Gi | +| `d1.2xmedium` | 2 | 4Gi | +| `d1.4xlarge` | 16 | 64Gi | +| `d1.8xlarge` | 32 | 128Gi | +| `d1.large` | 2 | 8Gi | +| `d1.medium` | 1 | 4Gi | +| `d1.micro` | 1 | 1Gi | +| `d1.nano` | 1 | 512Mi | +| `d1.small` | 1 | 2Gi | +| `d1.xlarge` | 4 | 16Gi | +| `gn1.2xlarge` | 8 | 32Gi | +| `gn1.4xlarge` | 16 | 64Gi | +| `gn1.8xlarge` | 32 | 128Gi | +| `gn1.xlarge` | 4 | 16Gi | +| `m1.2xlarge` | 8 | 64Gi | +| `m1.2xlarge1gi` | 8 | 64Gi | +| `m1.4xlarge` | 16 | 128Gi | +| `m1.4xlarge1gi` | 16 | 128Gi | +| `m1.8xlarge` | 32 | 256Gi | +| `m1.8xlarge1gi` | 32 | 256Gi | +| `m1.large` | 2 | 16Gi | +| `m1.large1gi` | 2 | 16Gi | +| `m1.xlarge` | 4 | 32Gi | +| `m1.xlarge1gi` | 4 | 32Gi | +| `n1.2xlarge` | 16 | 32Gi | +| `n1.4xlarge` | 32 | 64Gi | +| `n1.8xlarge` | 64 | 128Gi | +| `n1.large` | 4 | 8Gi | +| `n1.medium` | 4 | 4Gi | +| `n1.xlarge` | 8 | 16Gi | +| `o1.2xlarge` | 8 | 32Gi | +| `o1.4xlarge` | 16 | 64Gi | +| `o1.8xlarge` | 32 | 128Gi | +| `o1.large` | 2 | 8Gi | +| `o1.medium` | 1 | 4Gi | +| `o1.micro` | 1 | 1Gi | +| `o1.nano` | 1 | 512Mi | +| `o1.small` | 1 | 2Gi | +| `o1.xlarge` | 4 | 16Gi | +| `rt1.2xlarge` | 8 | 32Gi | +| `rt1.4xlarge` | 16 | 64Gi | +| `rt1.8xlarge` | 32 | 128Gi | +| `rt1.large` | 2 | 8Gi | +| `rt1.medium` | 1 | 4Gi | +| `rt1.micro` | 1 | 1Gi | +| `rt1.small` | 1 | 2Gi | +| `rt1.xlarge` | 4 | 16Gi | +| `u1.2xlarge` | 8 | 32Gi | +| `u1.2xmedium` | 2 | 4Gi | +| `u1.4xlarge` | 16 | 64Gi | +| `u1.8xlarge` | 32 | 128Gi | +| `u1.large` | 2 | 8Gi | +| `u1.medium` | 1 | 4Gi | +| `u1.micro` | 1 | 1Gi | +| `u1.nano` | 1 | 512Mi | +| `u1.small` | 1 | 2Gi | +| `u1.xlarge` | 4 | 16Gi | ### Kubelet Resource Reservations diff --git a/packages/apps/vm-instance/README.md b/packages/apps/vm-instance/README.md index 9d6a52b27..c1a016073 100644 --- a/packages/apps/vm-instance/README.md +++ b/packages/apps/vm-instance/README.md @@ -184,20 +184,41 @@ The following instancetype resources are provided by Cozystack: Name | vCPUs | Memory -----|-------|------- cx1.2xlarge | 8 | 16Gi +cx1.2xlarge1gi | 8 | 16Gi cx1.4xlarge | 16 | 32Gi +cx1.4xlarge1gi | 16 | 32Gi cx1.8xlarge | 32 | 64Gi +cx1.8xlarge1gi | 32 | 64Gi cx1.large | 2 | 4Gi +cx1.large1gi | 2 | 4Gi cx1.medium | 1 | 2Gi +cx1.medium1gi | 1 | 2Gi cx1.xlarge | 4 | 8Gi +cx1.xlarge1gi | 4 | 8Gi +d1.2xlarge | 8 | 32Gi +d1.2xmedium | 2 | 4Gi +d1.4xlarge | 16 | 64Gi +d1.8xlarge | 32 | 128Gi +d1.large | 2 | 8Gi +d1.medium | 1 | 4Gi +d1.micro | 1 | 1Gi +d1.nano | 1 | 512Mi +d1.small | 1 | 2Gi +d1.xlarge | 4 | 16Gi gn1.2xlarge | 8 | 32Gi gn1.4xlarge | 16 | 64Gi gn1.8xlarge | 32 | 128Gi gn1.xlarge | 4 | 16Gi m1.2xlarge | 8 | 64Gi +m1.2xlarge1gi | 8 | 64Gi m1.4xlarge | 16 | 128Gi +m1.4xlarge1gi | 16 | 128Gi m1.8xlarge | 32 | 256Gi +m1.8xlarge1gi | 32 | 256Gi m1.large | 2 | 16Gi +m1.large1gi | 2 | 16Gi m1.xlarge | 4 | 32Gi +m1.xlarge1gi | 4 | 32Gi n1.2xlarge | 16 | 32Gi n1.4xlarge | 32 | 64Gi n1.8xlarge | 64 | 128Gi @@ -237,23 +258,26 @@ The following preference resources are provided by Cozystack: Name | Guest OS -----|--------- alpine | Alpine -centos.7 | CentOS 7 -centos.7.desktop | CentOS 7 centos.stream10 | CentOS Stream 10 centos.stream10.desktop | CentOS Stream 10 -centos.stream8 | CentOS Stream 8 -centos.stream8.desktop | CentOS Stream 8 -centos.stream8.dpdk | CentOS Stream 8 centos.stream9 | CentOS Stream 9 centos.stream9.desktop | CentOS Stream 9 centos.stream9.dpdk | CentOS Stream 9 cirros | Cirros +debian | Debian fedora | Fedora (amd64) fedora.arm64 | Fedora (arm64) +fedora.s390x | Fedora (s390x) +legacy | Legacy Guest +linux | Linux Guest +linux.efi | Linux EFI Guest +linux.virtiotransitional | Linux Virtio Transitional Guest opensuse.leap | OpenSUSE Leap opensuse.tumbleweed | OpenSUSE Tumbleweed -rhel.10 | Red Hat Enterprise Linux 10 Beta (amd64) -rhel.10.arm64 | Red Hat Enterprise Linux 10 Beta (arm64) +oraclelinux | Oracle Linux +rhel.10 | Red Hat Enterprise Linux 10 (amd64) +rhel.10.arm64 | Red Hat Enterprise Linux 10 (arm64) +rhel.10.s390x | Red Hat Enterprise Linux 10 (s390x) rhel.7 | Red Hat Enterprise Linux 7 rhel.7.desktop | Red Hat Enterprise Linux 7 rhel.8 | Red Hat Enterprise Linux 8 @@ -264,12 +288,15 @@ rhel.9.arm64 | Red Hat Enterprise Linux 9 (arm64) rhel.9.desktop | Red Hat Enterprise Linux 9 Desktop (amd64) rhel.9.dpdk | Red Hat Enterprise Linux 9 DPDK (amd64) rhel.9.realtime | Red Hat Enterprise Linux 9 Realtime (amd64) +rhel.9.s390x | Red Hat Enterprise Linux 9 (s390x) sles | SUSE Linux Enterprise Server ubuntu | Ubuntu windows.10 | Microsoft Windows 10 windows.10.virtio | Microsoft Windows 10 (virtio) windows.11 | Microsoft Windows 11 windows.11.virtio | Microsoft Windows 11 (virtio) +windows.2k12 | Microsoft Windows Server 2012/2012 R2 +windows.2k12.virtio | Microsoft Windows Server 2012/2012 R2 (virtio) windows.2k16 | Microsoft Windows Server 2016 windows.2k16.virtio | Microsoft Windows Server 2016 (virtio) windows.2k19 | Microsoft Windows Server 2019 @@ -278,3 +305,9 @@ windows.2k22 | Microsoft Windows Server 2022 windows.2k22.virtio | Microsoft Windows Server 2022 (virtio) windows.2k25 | Microsoft Windows Server 2025 windows.2k25.virtio | Microsoft Windows Server 2025 (virtio) +windows.2k3 | Microsoft Windows Server 2003 +windows.2k8 | Microsoft Windows Server 2008/2008 R2 +windows.2k8.virtio | Microsoft Windows Server 2008/2008 R2 (virtio) +windows.7 | Microsoft Windows 7 +windows.7.virtio | Microsoft Windows 7 (virtio) +windows.xp | Microsoft Windows XP diff --git a/packages/system/kubevirt-instancetypes/Makefile b/packages/system/kubevirt-instancetypes/Makefile index f5970d9b9..99771e976 100644 --- a/packages/system/kubevirt-instancetypes/Makefile +++ b/packages/system/kubevirt-instancetypes/Makefile @@ -3,10 +3,21 @@ export NAMESPACE=cozy-kubevirt include ../../../hack/package.mk +# Pin common-instancetypes for reproducible regeneration. Building from an +# unpinned default branch silently churns the catalog on every `make update`. +# This is a commit SHA rather than a release tag on purpose: the multi-arch +# preferredArchitecture / requirements.architecture fields (KubeVirt 1.8) only +# exist on main past the latest tag (v1.6.0), so a tag would regress them. +# Bump COMMON_INSTANCETYPES_REF deliberately and review the resulting diff. +COMMON_INSTANCETYPES_REF ?= 3a552da6065aebb7900b1c63b2f477c2ec9ed687 + update: rm -rf templates mkdir templates - kustomize build https://github.com/kubevirt/common-instancetypes/preferences > templates/preferences.yaml + kustomize build https://github.com/kubevirt/common-instancetypes/preferences?ref=$(COMMON_INSTANCETYPES_REF) > templates/preferences.yaml yq -i 'select(.kind != "VirtualMachinePreference")' templates/preferences.yaml - kustomize build https://github.com/kubevirt/common-instancetypes/instancetypes > templates/instancetypes.yaml + kustomize build https://github.com/kubevirt/common-instancetypes/instancetypes?ref=$(COMMON_INSTANCETYPES_REF) > templates/instancetypes.yaml yq -i 'select(.kind != "VirtualMachineInstancetype")' templates/instancetypes.yaml + # Re-append Cozystack-local instancetypes the pinned catalog no longer ships + # but existing workloads still reference (see extra-instancetypes.yaml). + cp extra-instancetypes.yaml templates/extra-instancetypes.yaml diff --git a/packages/system/kubevirt-instancetypes/extra-instancetypes.yaml b/packages/system/kubevirt-instancetypes/extra-instancetypes.yaml new file mode 100644 index 000000000..2daf0f00e --- /dev/null +++ b/packages/system/kubevirt-instancetypes/extra-instancetypes.yaml @@ -0,0 +1,153 @@ +# Cozystack-local instancetypes retained on top of the pinned upstream +# common-instancetypes catalog (see Makefile `update`). +# +# The gn1.* (GPU NVIDIA) series was removed upstream in common-instancetypes +# v1.3.0, but existing GPU VMs and tenant Kubernetes GPU worker pools still +# reference these names, and packages/apps/vm-instance/templates/vm.yaml fails +# the Helm render when a referenced VirtualMachineClusterInstancetype is absent. +# These objects are appended to templates/ verbatim from the pre-v1.3.0 catalog +# to keep those workloads renderable. They are marked deprecated upstream; new +# GPU instancetypes should be defined explicitly rather than extending this set. +apiVersion: instancetype.kubevirt.io/v1beta1 +kind: VirtualMachineClusterInstancetype +metadata: + annotations: + instancetype.kubevirt.io/description: |- + The GN Series provides instances types intended for VMs with + NVIDIA GPU resources attached. + + *GN* is the abbreviation of "GPU NVIDIA". + + This series is intended to be used with VMs consuming GPUs + provided by the + [NVIDIA GPU Operator](https://github.com/NVIDIA/gpu-operator) + which can be installed on Kubernetes and also is made available + on OpenShift via OperatorHub. + instancetype.kubevirt.io/displayName: GPU NVIDIA + labels: + instancetype.kubevirt.io/class: gpu.nvidia + instancetype.kubevirt.io/cpu: "8" + instancetype.kubevirt.io/deprecated: "true" + instancetype.kubevirt.io/gpus: "true" + instancetype.kubevirt.io/icon-pf: fa-microchip + instancetype.kubevirt.io/memory: 32Gi + instancetype.kubevirt.io/size: 2xlarge + instancetype.kubevirt.io/vendor: kubevirt.io + instancetype.kubevirt.io/version: "1" + name: gn1.2xlarge +spec: + cpu: + guest: 8 + gpus: + - deviceName: nvidia.com/A400 + name: gpu1 + memory: + guest: 32Gi +--- +apiVersion: instancetype.kubevirt.io/v1beta1 +kind: VirtualMachineClusterInstancetype +metadata: + annotations: + instancetype.kubevirt.io/description: |- + The GN Series provides instances types intended for VMs with + NVIDIA GPU resources attached. + + *GN* is the abbreviation of "GPU NVIDIA". + + This series is intended to be used with VMs consuming GPUs + provided by the + [NVIDIA GPU Operator](https://github.com/NVIDIA/gpu-operator) + which can be installed on Kubernetes and also is made available + on OpenShift via OperatorHub. + instancetype.kubevirt.io/displayName: GPU NVIDIA + labels: + instancetype.kubevirt.io/class: gpu.nvidia + instancetype.kubevirt.io/cpu: "16" + instancetype.kubevirt.io/deprecated: "true" + instancetype.kubevirt.io/gpus: "true" + instancetype.kubevirt.io/icon-pf: fa-microchip + instancetype.kubevirt.io/memory: 64Gi + instancetype.kubevirt.io/size: 4xlarge + instancetype.kubevirt.io/vendor: kubevirt.io + instancetype.kubevirt.io/version: "1" + name: gn1.4xlarge +spec: + cpu: + guest: 16 + gpus: + - deviceName: nvidia.com/A400 + name: gpu1 + memory: + guest: 64Gi +--- +apiVersion: instancetype.kubevirt.io/v1beta1 +kind: VirtualMachineClusterInstancetype +metadata: + annotations: + instancetype.kubevirt.io/description: |- + The GN Series provides instances types intended for VMs with + NVIDIA GPU resources attached. + + *GN* is the abbreviation of "GPU NVIDIA". + + This series is intended to be used with VMs consuming GPUs + provided by the + [NVIDIA GPU Operator](https://github.com/NVIDIA/gpu-operator) + which can be installed on Kubernetes and also is made available + on OpenShift via OperatorHub. + instancetype.kubevirt.io/displayName: GPU NVIDIA + labels: + instancetype.kubevirt.io/class: gpu.nvidia + instancetype.kubevirt.io/cpu: "32" + instancetype.kubevirt.io/deprecated: "true" + instancetype.kubevirt.io/gpus: "true" + instancetype.kubevirt.io/icon-pf: fa-microchip + instancetype.kubevirt.io/memory: 128Gi + instancetype.kubevirt.io/size: 8xlarge + instancetype.kubevirt.io/vendor: kubevirt.io + instancetype.kubevirt.io/version: "1" + name: gn1.8xlarge +spec: + cpu: + guest: 32 + gpus: + - deviceName: nvidia.com/A400 + name: gpu1 + memory: + guest: 128Gi +--- +apiVersion: instancetype.kubevirt.io/v1beta1 +kind: VirtualMachineClusterInstancetype +metadata: + annotations: + instancetype.kubevirt.io/description: |- + The GN Series provides instances types intended for VMs with + NVIDIA GPU resources attached. + + *GN* is the abbreviation of "GPU NVIDIA". + + This series is intended to be used with VMs consuming GPUs + provided by the + [NVIDIA GPU Operator](https://github.com/NVIDIA/gpu-operator) + which can be installed on Kubernetes and also is made available + on OpenShift via OperatorHub. + instancetype.kubevirt.io/displayName: GPU NVIDIA + labels: + instancetype.kubevirt.io/class: gpu.nvidia + instancetype.kubevirt.io/cpu: "4" + instancetype.kubevirt.io/deprecated: "true" + instancetype.kubevirt.io/gpus: "true" + instancetype.kubevirt.io/icon-pf: fa-microchip + instancetype.kubevirt.io/memory: 16Gi + instancetype.kubevirt.io/size: xlarge + instancetype.kubevirt.io/vendor: kubevirt.io + instancetype.kubevirt.io/version: "1" + name: gn1.xlarge +spec: + cpu: + guest: 4 + gpus: + - deviceName: nvidia.com/A400 + name: gpu1 + memory: + guest: 16Gi diff --git a/packages/system/kubevirt-instancetypes/templates/extra-instancetypes.yaml b/packages/system/kubevirt-instancetypes/templates/extra-instancetypes.yaml new file mode 100644 index 000000000..2daf0f00e --- /dev/null +++ b/packages/system/kubevirt-instancetypes/templates/extra-instancetypes.yaml @@ -0,0 +1,153 @@ +# Cozystack-local instancetypes retained on top of the pinned upstream +# common-instancetypes catalog (see Makefile `update`). +# +# The gn1.* (GPU NVIDIA) series was removed upstream in common-instancetypes +# v1.3.0, but existing GPU VMs and tenant Kubernetes GPU worker pools still +# reference these names, and packages/apps/vm-instance/templates/vm.yaml fails +# the Helm render when a referenced VirtualMachineClusterInstancetype is absent. +# These objects are appended to templates/ verbatim from the pre-v1.3.0 catalog +# to keep those workloads renderable. They are marked deprecated upstream; new +# GPU instancetypes should be defined explicitly rather than extending this set. +apiVersion: instancetype.kubevirt.io/v1beta1 +kind: VirtualMachineClusterInstancetype +metadata: + annotations: + instancetype.kubevirt.io/description: |- + The GN Series provides instances types intended for VMs with + NVIDIA GPU resources attached. + + *GN* is the abbreviation of "GPU NVIDIA". + + This series is intended to be used with VMs consuming GPUs + provided by the + [NVIDIA GPU Operator](https://github.com/NVIDIA/gpu-operator) + which can be installed on Kubernetes and also is made available + on OpenShift via OperatorHub. + instancetype.kubevirt.io/displayName: GPU NVIDIA + labels: + instancetype.kubevirt.io/class: gpu.nvidia + instancetype.kubevirt.io/cpu: "8" + instancetype.kubevirt.io/deprecated: "true" + instancetype.kubevirt.io/gpus: "true" + instancetype.kubevirt.io/icon-pf: fa-microchip + instancetype.kubevirt.io/memory: 32Gi + instancetype.kubevirt.io/size: 2xlarge + instancetype.kubevirt.io/vendor: kubevirt.io + instancetype.kubevirt.io/version: "1" + name: gn1.2xlarge +spec: + cpu: + guest: 8 + gpus: + - deviceName: nvidia.com/A400 + name: gpu1 + memory: + guest: 32Gi +--- +apiVersion: instancetype.kubevirt.io/v1beta1 +kind: VirtualMachineClusterInstancetype +metadata: + annotations: + instancetype.kubevirt.io/description: |- + The GN Series provides instances types intended for VMs with + NVIDIA GPU resources attached. + + *GN* is the abbreviation of "GPU NVIDIA". + + This series is intended to be used with VMs consuming GPUs + provided by the + [NVIDIA GPU Operator](https://github.com/NVIDIA/gpu-operator) + which can be installed on Kubernetes and also is made available + on OpenShift via OperatorHub. + instancetype.kubevirt.io/displayName: GPU NVIDIA + labels: + instancetype.kubevirt.io/class: gpu.nvidia + instancetype.kubevirt.io/cpu: "16" + instancetype.kubevirt.io/deprecated: "true" + instancetype.kubevirt.io/gpus: "true" + instancetype.kubevirt.io/icon-pf: fa-microchip + instancetype.kubevirt.io/memory: 64Gi + instancetype.kubevirt.io/size: 4xlarge + instancetype.kubevirt.io/vendor: kubevirt.io + instancetype.kubevirt.io/version: "1" + name: gn1.4xlarge +spec: + cpu: + guest: 16 + gpus: + - deviceName: nvidia.com/A400 + name: gpu1 + memory: + guest: 64Gi +--- +apiVersion: instancetype.kubevirt.io/v1beta1 +kind: VirtualMachineClusterInstancetype +metadata: + annotations: + instancetype.kubevirt.io/description: |- + The GN Series provides instances types intended for VMs with + NVIDIA GPU resources attached. + + *GN* is the abbreviation of "GPU NVIDIA". + + This series is intended to be used with VMs consuming GPUs + provided by the + [NVIDIA GPU Operator](https://github.com/NVIDIA/gpu-operator) + which can be installed on Kubernetes and also is made available + on OpenShift via OperatorHub. + instancetype.kubevirt.io/displayName: GPU NVIDIA + labels: + instancetype.kubevirt.io/class: gpu.nvidia + instancetype.kubevirt.io/cpu: "32" + instancetype.kubevirt.io/deprecated: "true" + instancetype.kubevirt.io/gpus: "true" + instancetype.kubevirt.io/icon-pf: fa-microchip + instancetype.kubevirt.io/memory: 128Gi + instancetype.kubevirt.io/size: 8xlarge + instancetype.kubevirt.io/vendor: kubevirt.io + instancetype.kubevirt.io/version: "1" + name: gn1.8xlarge +spec: + cpu: + guest: 32 + gpus: + - deviceName: nvidia.com/A400 + name: gpu1 + memory: + guest: 128Gi +--- +apiVersion: instancetype.kubevirt.io/v1beta1 +kind: VirtualMachineClusterInstancetype +metadata: + annotations: + instancetype.kubevirt.io/description: |- + The GN Series provides instances types intended for VMs with + NVIDIA GPU resources attached. + + *GN* is the abbreviation of "GPU NVIDIA". + + This series is intended to be used with VMs consuming GPUs + provided by the + [NVIDIA GPU Operator](https://github.com/NVIDIA/gpu-operator) + which can be installed on Kubernetes and also is made available + on OpenShift via OperatorHub. + instancetype.kubevirt.io/displayName: GPU NVIDIA + labels: + instancetype.kubevirt.io/class: gpu.nvidia + instancetype.kubevirt.io/cpu: "4" + instancetype.kubevirt.io/deprecated: "true" + instancetype.kubevirt.io/gpus: "true" + instancetype.kubevirt.io/icon-pf: fa-microchip + instancetype.kubevirt.io/memory: 16Gi + instancetype.kubevirt.io/size: xlarge + instancetype.kubevirt.io/vendor: kubevirt.io + instancetype.kubevirt.io/version: "1" + name: gn1.xlarge +spec: + cpu: + guest: 4 + gpus: + - deviceName: nvidia.com/A400 + name: gpu1 + memory: + guest: 16Gi From e44457aca978bfd25f327b311b109a91c8b6808b Mon Sep 17 00:00:00 2001 From: Myasnikov Daniil Date: Sun, 31 May 2026 15:02:24 +0500 Subject: [PATCH 22/28] docs(application): correct stale helm-install-timeout annotation comment tenant-rd now carries release.cozystack.io/helm-install-timeout alongside kubernetes-rd (its parent chart bootstraps the seaweedfs-db CNPG cluster, whose first reconcile exceeds flux's default wait budget). Update the comment that claimed only kubernetes-rd carries it. Assisted-By: Claude Signed-off-by: Myasnikov Daniil --- pkg/registry/apps/application/rest.go | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/pkg/registry/apps/application/rest.go b/pkg/registry/apps/application/rest.go index e67653c28..9770ef0fa 100644 --- a/pkg/registry/apps/application/rest.go +++ b/pkg/registry/apps/application/rest.go @@ -1581,12 +1581,14 @@ func (r *REST) convertApplicationToHelmRelease(app *appsv1alpha1.Application) (* // Upgrade.Timeout populated from ReleaseConfig.HelmInstallTimeout // (parsed at startup). Applications that leave it unset keep flux // defaults so their failed installs remediate on the normal cadence. - // Today only kubernetes-rd carries the annotation because the + // kubernetes-rd and tenant-rd carry the annotation today: the // Kubernetes Application's parent chart contains CAPI/Kamaji // resources whose admin-kubeconfig Secret is provisioned // asynchronously and Kamaji cold-start routinely exceeds flux's - // default wait budget; any future kind with the same shape can opt - // in by setting the same annotation. + // default wait budget, and the Tenant parent chart bootstraps the + // seaweedfs-db CNPG cluster whose first reconcile exceeds it too. + // Any future kind with the same shape can opt in by setting the + // same annotation. if r.releaseConfig.HelmInstallTimeout > 0 { timeout := metav1.Duration{Duration: r.releaseConfig.HelmInstallTimeout} helmRelease.Spec.Install.Timeout = &timeout From 57c0ce66bc9d48d2d0c1a34b7de28252f97fb8e0 Mon Sep 17 00:00:00 2001 From: Myasnikov Daniil Date: Sun, 31 May 2026 15:02:33 +0500 Subject: [PATCH 23/28] test: cover flux v2.8 chart fixes and wire missing test targets - kafka: assert WorkloadMonitor reads .Values.kafka.replicas / .Values.zookeeper.replicas (regression for the phantom .Values.replicas), and that enableServiceLinks lives under entityOperator.template.pod. - tenant: pin that no swept HelmRelease carries upgrade.force (would have caught the missed gateway.yaml). - seaweedfs-db: baseline render cover for the new split-out chart. - kafka and seaweedfs-db had no `test` Makefile target, so their suites never ran in CI; add one to each. Assisted-By: Claude Signed-off-by: Myasnikov Daniil --- packages/apps/kafka/Makefile | 3 + .../tests/entityoperator_template_test.yaml | 22 ++++++ .../kafka/tests/workloadmonitor_test.yaml | 70 +++++++++++++++++++ .../tenant/tests/no_upgrade_force_test.yaml | 69 ++++++++++++++++++ packages/system/seaweedfs-db/Makefile | 3 + .../seaweedfs-db/tests/database_test.yaml | 62 ++++++++++++++++ 6 files changed, 229 insertions(+) create mode 100644 packages/apps/kafka/tests/entityoperator_template_test.yaml create mode 100644 packages/apps/kafka/tests/workloadmonitor_test.yaml create mode 100644 packages/apps/tenant/tests/no_upgrade_force_test.yaml create mode 100644 packages/system/seaweedfs-db/tests/database_test.yaml diff --git a/packages/apps/kafka/Makefile b/packages/apps/kafka/Makefile index c1084e865..2df10791f 100644 --- a/packages/apps/kafka/Makefile +++ b/packages/apps/kafka/Makefile @@ -1,6 +1,9 @@ include ../../../hack/package.mk PRESET_ENUM := ["nano","micro","small","medium","large","xlarge","2xlarge"] +test: + helm unittest . + generate: cozyvalues-gen -m 'kafka' -v values.yaml -s values.schema.json -r README.md -g ../../../api/apps/v1alpha1/kafka/types.go ../../../hack/update-crd.sh diff --git a/packages/apps/kafka/tests/entityoperator_template_test.yaml b/packages/apps/kafka/tests/entityoperator_template_test.yaml new file mode 100644 index 000000000..95b792138 --- /dev/null +++ b/packages/apps/kafka/tests/entityoperator_template_test.yaml @@ -0,0 +1,22 @@ +suite: Kafka entityOperator pod template + +# Regression cover for the strict-SSA fix that moved enableServiceLinks out of +# a phantom `entityOperator.template.spec` key (silently dropped by Flux v2.7, +# rejected by v2.8 SSA as "field not declared in schema") into the flat +# `entityOperator.template.pod` set where the Strimzi CRD actually reads it. + +templates: + - templates/kafka.yaml + +tests: + - it: enableServiceLinks lives under entityOperator.template.pod + release: + name: test-kafka + namespace: tenant-test + asserts: + - equal: + path: spec.entityOperator.template.pod.enableServiceLinks + value: false + # the phantom template.spec key must not reappear + - notExists: + path: spec.entityOperator.template.spec diff --git a/packages/apps/kafka/tests/workloadmonitor_test.yaml b/packages/apps/kafka/tests/workloadmonitor_test.yaml new file mode 100644 index 000000000..b4a268da0 --- /dev/null +++ b/packages/apps/kafka/tests/workloadmonitor_test.yaml @@ -0,0 +1,70 @@ +suite: Kafka WorkloadMonitor replica paths + +# Regression cover for the fix that split the WorkloadMonitor replica +# source from a single phantom `.Values.replicas` (which does not exist in +# this chart's values — kafka and zookeeper carry their own counts) into the +# correct `.Values.kafka.replicas` and `.Values.zookeeper.replicas`. Before +# the fix both monitors rendered `replicas:` empty, so the workload-monitor +# controller never knew the expected replica count. + +templates: + - templates/workloadmonitor.yaml + +tests: + - it: kafka and zookeeper monitors read their own replica counts + release: + name: test-kafka + namespace: tenant-test + set: + kafka: + replicas: 5 + zookeeper: + replicas: 2 + asserts: + - hasDocuments: + count: 2 + # doc 0 — kafka monitor + - documentIndex: 0 + equal: + path: metadata.name + value: test-kafka + - documentIndex: 0 + equal: + path: spec.type + value: kafka + - documentIndex: 0 + equal: + path: spec.replicas + value: 5 + # doc 1 — zookeeper monitor + - documentIndex: 1 + equal: + path: metadata.name + value: test-kafka-zookeeper + - documentIndex: 1 + equal: + path: spec.type + value: zookeeper + - documentIndex: 1 + equal: + path: spec.replicas + value: 2 + + - it: replica counts stay independent (kafka != zookeeper) + release: + name: test-kafka + namespace: tenant-test + set: + kafka: + replicas: 7 + zookeeper: + replicas: 3 + asserts: + - documentIndex: 0 + equal: + path: spec.replicas + value: 7 + - documentIndex: 1 + equal: + path: spec.replicas + value: 3 diff --git a/packages/apps/tenant/tests/no_upgrade_force_test.yaml b/packages/apps/tenant/tests/no_upgrade_force_test.yaml new file mode 100644 index 000000000..80be5a9c6 --- /dev/null +++ b/packages/apps/tenant/tests/no_upgrade_force_test.yaml @@ -0,0 +1,69 @@ +suite: tenant HelmReleases carry no deprecated upgrade.force + +# Flux v2.8 / helm-controller v1.5 deprecates `upgrade.force: true` and rejects +# it under Server-Side Apply. The flux-bump PR swept the flag off every tenant +# HelmRelease; gateway.yaml was missed in the first pass. This suite pins the +# invariant across all swept HRs so a stray `force: true` cannot creep back in. + +# Restrict rendering to the swept HelmRelease templates so the chart's +# namespace.yaml `lookup` (which errors under helm-unittest) is not evaluated. +templates: + - templates/etcd.yaml + - templates/info.yaml + - templates/ingress.yaml + - templates/monitoring.yaml + - templates/seaweedfs.yaml + - templates/gateway.yaml + +release: + name: tenant-test + namespace: tenant-test + +set: + _cluster: + expose-ingress: tenant-root + expose-external-ips: "192.0.2.10" + gateway-enabled: "true" + etcd: true + ingress: true + monitoring: true + seaweedfs: true + gateway: true + host: "" + +tests: + - it: etcd HR has no upgrade.force + asserts: + - template: templates/etcd.yaml + notExists: + path: spec.upgrade.force + + - it: info HR has no upgrade.force + asserts: + - template: templates/info.yaml + notExists: + path: spec.upgrade.force + + - it: ingress HR has no upgrade.force + asserts: + - template: templates/ingress.yaml + notExists: + path: spec.upgrade.force + + - it: monitoring HR has no upgrade.force + asserts: + - template: templates/monitoring.yaml + notExists: + path: spec.upgrade.force + + - it: seaweedfs HR has no upgrade.force + asserts: + - template: templates/seaweedfs.yaml + notExists: + path: spec.upgrade.force + + - it: gateway HR has no upgrade.force + asserts: + - template: templates/gateway.yaml + notExists: + path: spec.upgrade.force diff --git a/packages/system/seaweedfs-db/Makefile b/packages/system/seaweedfs-db/Makefile index 73eda9d42..0456f28d6 100644 --- a/packages/system/seaweedfs-db/Makefile +++ b/packages/system/seaweedfs-db/Makefile @@ -2,3 +2,6 @@ export NAME=seaweedfs-db include ../../../hack/common-envs.mk include ../../../hack/package.mk + +test: + helm unittest . diff --git a/packages/system/seaweedfs-db/tests/database_test.yaml b/packages/system/seaweedfs-db/tests/database_test.yaml new file mode 100644 index 000000000..3eff5a112 --- /dev/null +++ b/packages/system/seaweedfs-db/tests/database_test.yaml @@ -0,0 +1,62 @@ +suite: seaweedfs-db CNPG Cluster + +# Baseline render cover for the chart introduced by the seaweedfs split. The +# split moved the filer metadata Cluster into its own release; this pins the +# shape (instances from db.replicas, configurable storage, the fresh-install +# image default, and the apiserver-allow label) so a regression in the new +# chart is caught before it reaches a tenant's metadata database. + +templates: + - templates/database.yaml + +tests: + - it: renders a CNPG Cluster named seaweedfs-db + release: + name: seaweedfs-db + namespace: cozy-seaweedfs + asserts: + - hasDocuments: + count: 1 + - isKind: + of: Cluster + - equal: + path: metadata.name + value: seaweedfs-db + + - it: instances and storage follow db values + release: + name: seaweedfs-db + namespace: cozy-seaweedfs + set: + db: + replicas: 3 + size: 25Gi + storageClass: replicated + asserts: + - equal: + path: spec.instances + value: 3 + - equal: + path: spec.storage.size + value: 25Gi + - equal: + path: spec.storage.storageClass + value: replicated + + - it: fresh install pins the default postgres 17.7 image + release: + name: seaweedfs-db + namespace: cozy-seaweedfs + asserts: + - equal: + path: spec.imageName + value: ghcr.io/cloudnative-pg/postgresql:17.7-standard-trixie + + - it: carries the apiserver-allow inherited label + release: + name: seaweedfs-db + namespace: cozy-seaweedfs + asserts: + - equal: + path: spec.inheritedMetadata.labels["policy.cozystack.io/allow-to-apiserver"] + value: "true" From 5c4e9277fcdf0f9bc1065ef161eff7a8235bf51f Mon Sep 17 00:00:00 2001 From: Myasnikov Daniil Date: Sun, 31 May 2026 18:39:36 +0500 Subject: [PATCH 24/28] fix(foundationdb): regenerate types.go and README for split imageType default MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The imageType default was switched to split in values.yaml/values.schema.json/ RD schema but make generate was not run, leaving the +kubebuilder:default marker in api/apps/v1alpha1/foundationdb/types.go at "unified" and the README param table sized for the old value — failing the pre-commit generate check (exit 123). Regenerated with cozyvalues-gen v1.5.0. Assisted-By: Claude Signed-off-by: Myasnikov Daniil --- api/apps/v1alpha1/foundationdb/types.go | 2 +- packages/apps/foundationdb/README.md | 14 +++++++------- 2 files changed, 8 insertions(+), 8 deletions(-) diff --git a/api/apps/v1alpha1/foundationdb/types.go b/api/apps/v1alpha1/foundationdb/types.go index 0856d4c8b..fa801afbf 100644 --- a/api/apps/v1alpha1/foundationdb/types.go +++ b/api/apps/v1alpha1/foundationdb/types.go @@ -39,7 +39,7 @@ type ConfigSpec struct { // +kubebuilder:default:={} CustomParameters []string `json:"customParameters,omitempty"` // Container image deployment type. - // +kubebuilder:default:="unified" + // +kubebuilder:default:="split" ImageType ImageType `json:"imageType"` // Security context for containers. // +kubebuilder:default:={} diff --git a/packages/apps/foundationdb/README.md b/packages/apps/foundationdb/README.md index 5ee45b65e..c253bc67e 100644 --- a/packages/apps/foundationdb/README.md +++ b/packages/apps/foundationdb/README.md @@ -191,12 +191,12 @@ For Cozystack-specific issues, consult the Cozystack documentation or support ch ### FoundationDB configuration -| Name | Description | Type | Value | -| ---------------------------- | ------------------------------------------ | ---------- | --------- | -| `customParameters` | Custom parameters to pass to FoundationDB. | `[]string` | `[]` | +| Name | Description | Type | Value | +| ---------------------------- | ------------------------------------------ | ---------- | ------- | +| `customParameters` | Custom parameters to pass to FoundationDB. | `[]string` | `[]` | | `imageType` | Container image deployment type. | `string` | `split` | -| `securityContext` | Security context for containers. | `object` | `{}` | -| `securityContext.runAsUser` | User ID to run the container. | `int` | `4059` | -| `securityContext.runAsGroup` | Group ID to run the container. | `int` | `4059` | -| `automaticReplacements` | Enable automatic pod replacements. | `bool` | `true` | +| `securityContext` | Security context for containers. | `object` | `{}` | +| `securityContext.runAsUser` | User ID to run the container. | `int` | `4059` | +| `securityContext.runAsGroup` | Group ID to run the container. | `int` | `4059` | +| `automaticReplacements` | Enable automatic pod replacements. | `bool` | `true` | From fd59dea23472526d217048053ca0a4884968e1df Mon Sep 17 00:00:00 2001 From: Myasnikov Daniil Date: Sun, 31 May 2026 19:04:20 +0500 Subject: [PATCH 25/28] feat(fluxcd): bump flux-operator/flux-instance charts to v0.50.0 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Re-pull the vendored flux-operator and flux-instance charts from 0.48.0 to the latest v0.50.0 (operator-version bumps only: OpenShift v4.21 compat, OLM base image, Kubernetes client deps — no Flux distribution change). The kubernetesEnvs and networkPolicy patches re-apply cleanly. distribution.version stays 2.8.x, so the tenant Flux toolkit auto-tracks the latest 2.8 patch (currently 2.8.8) at reconcile. The management flux-aio module is already at its latest published build (2.8.0); no newer 2.8.x module exists upstream yet. Assisted-By: Claude Signed-off-by: Myasnikov Daniil --- .../charts/flux-operator/Chart.yaml | 4 +- .../charts/flux-operator/README.md | 3 +- .../charts/flux-operator/templates/crds.yaml | 46 +++++++++++++------ .../flux-operator/templates/service.yaml | 3 ++ .../charts/flux-operator/values.schema.json | 14 ++++++ .../charts/flux-operator/values.yaml | 4 ++ .../fluxcd/charts/flux-instance/Chart.yaml | 4 +- .../fluxcd/charts/flux-instance/README.md | 2 +- 8 files changed, 60 insertions(+), 20 deletions(-) diff --git a/packages/system/fluxcd-operator/charts/flux-operator/Chart.yaml b/packages/system/fluxcd-operator/charts/flux-operator/Chart.yaml index 897216a17..cfe790420 100644 --- a/packages/system/fluxcd-operator/charts/flux-operator/Chart.yaml +++ b/packages/system/fluxcd-operator/charts/flux-operator/Chart.yaml @@ -8,7 +8,7 @@ annotations: - name: Upstream Project url: https://github.com/controlplaneio-fluxcd/flux-operator apiVersion: v2 -appVersion: v0.48.0 +appVersion: v0.50.0 description: 'A Helm chart for deploying the Flux Operator. ' home: https://fluxoperator.dev icon: https://raw.githubusercontent.com/cncf/artwork/main/projects/flux/icon/color/flux-icon-color.png @@ -25,4 +25,4 @@ sources: - https://github.com/controlplaneio-fluxcd/flux-operator - https://github.com/controlplaneio-fluxcd/charts type: application -version: 0.48.0 +version: 0.50.0 diff --git a/packages/system/fluxcd-operator/charts/flux-operator/README.md b/packages/system/fluxcd-operator/charts/flux-operator/README.md index 87a0fcd32..8fa34b553 100644 --- a/packages/system/fluxcd-operator/charts/flux-operator/README.md +++ b/packages/system/fluxcd-operator/charts/flux-operator/README.md @@ -1,6 +1,6 @@ # flux-operator -![Version: 0.48.0](https://img.shields.io/badge/Version-0.48.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: v0.48.0](https://img.shields.io/badge/AppVersion-v0.48.0-informational?style=flat-square) +![Version: 0.50.0](https://img.shields.io/badge/Version-0.50.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: v0.50.0](https://img.shields.io/badge/AppVersion-v0.50.0-informational?style=flat-square) The [Flux Operator](https://github.com/controlplaneio-fluxcd/flux-operator) provides a declarative API for the installation and upgrade of CNCF [Flux](https://fluxcd.io) and the @@ -75,6 +75,7 @@ see the Flux Operator [documentation](https://fluxoperator.dev/docs/). | reporting | object | `{"interval":"5m"}` | Flux [reporting](https://fluxoperator.dev/docs/crd/fluxreport/) settings. | | resources | object | `{"limits":{"cpu":"2000m","memory":"1Gi"},"requests":{"cpu":"100m","memory":"64Mi"}}` | Container resources requests and limits settings. | | securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"readOnlyRootFilesystem":true,"runAsNonRoot":true,"seccompProfile":{"type":"RuntimeDefault"}}` | Container security context settings. The default is compliant with the pod security restricted profile. | +| service.ipFamilyPolicy | string | `""` | Sets the IP family policy on all Service resources. Uses Kubernetes defaults if unset | | serviceAccount | object | `{"automount":true,"create":true,"name":""}` | Pod service account settings. The name of the service account defaults to the release name. | | serviceMonitor | object | `{"create":false,"interval":"60s","labels":{},"scrapeTimeout":"30s"}` | Prometheus Operator scraping settings. | | tolerations | list | `[]` | Pod tolerations settings. | diff --git a/packages/system/fluxcd-operator/charts/flux-operator/templates/crds.yaml b/packages/system/fluxcd-operator/charts/flux-operator/templates/crds.yaml index 4549c3626..b9439f2d3 100644 --- a/packages/system/fluxcd-operator/charts/flux-operator/templates/crds.yaml +++ b/packages/system/fluxcd-operator/charts/flux-operator/templates/crds.yaml @@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.20.0 + controller-gen.kubebuilder.io/version: v0.21.0 helm.sh/resource-policy: keep labels: app.kubernetes.io/instance: '{{ .Release.Name }}' @@ -375,7 +375,8 @@ spec: description: |- Provider specifies OIDC provider for source authentication. For OCIRepository and Bucket the provider can be set to 'aws', 'azure' or 'gcp'. - for GitRepository the accepted value can be set to 'azure' or 'github'. + For GitRepository the provider can be set to 'aws' (requires Flux 2.9 or later), + 'azure' or 'github'. To disable OIDC authentication the provider can be set to 'generic' or left empty. enum: - generic @@ -409,6 +410,14 @@ spec: - ref - url type: object + x-kubernetes-validations: + - message: sync.provider 'gcp' is only supported for OCIRepository + and Bucket + rule: '!has(self.provider) || self.provider != ''gcp'' || self.kind + == ''OCIRepository'' || self.kind == ''Bucket''' + - message: sync.provider 'github' is only supported for GitRepository + rule: '!has(self.provider) || self.provider != ''github'' || self.kind + == ''GitRepository''' wait: default: true description: |- @@ -623,7 +632,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.20.0 + controller-gen.kubebuilder.io/version: v0.21.0 helm.sh/resource-policy: keep labels: app.kubernetes.io/instance: '{{ .Release.Name }}' @@ -926,7 +935,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.20.0 + controller-gen.kubebuilder.io/version: v0.21.0 helm.sh/resource-policy: keep labels: app.kubernetes.io/instance: '{{ .Release.Name }}' @@ -1146,6 +1155,9 @@ spec: - AzureDevOpsBranch - AzureDevOpsTag - AzureDevOpsPullRequest + - AWSCodeCommitBranch + - AWSCodeCommitTag + - AWSCodeCommitPullRequest - GiteaBranch - GiteaTag - GiteaPullRequest @@ -1174,8 +1186,12 @@ spec: is a Git provider rule: '!self.type.startsWith(''Git'') || self.url.startsWith(''http'')' - message: spec.url must start with 'http://' or 'https://' when spec.type - is a Git provider - rule: '!self.type.startsWith(''AzureDevOps'') || self.url.startsWith(''http'')' + is an AzureDevOps provider + rule: '!self.type.startsWith(''AzureDevOps'') || self.url.startsWith(''http://'') + || self.url.startsWith(''https://'')' + - message: spec.url must start with 'https://' when spec.type is a AWSCodeCommit + provider + rule: '!self.type.startsWith(''AWSCodeCommit'') || self.url.startsWith(''https://'')' - message: spec.url must start with 'oci://' when spec.type is an OCI provider rule: '!self.type.endsWith(''ArtifactTag'') || self.url.startsWith(''oci'')' @@ -1190,17 +1206,19 @@ spec: rule: self.type != 'ExternalService' || !self.url.startsWith('http://') || (has(self.insecure) && self.insecure) - message: cannot specify spec.serviceAccountName when spec.type is not - one of AzureDevOps* or *ArtifactTag + one of AzureDevOps*, AWSCodeCommit* or *ArtifactTag rule: '!has(self.serviceAccountName) || self.type.startsWith(''AzureDevOps'') - || self.type.endsWith(''ArtifactTag'')' + || self.type.startsWith(''AWSCodeCommit'') || self.type.endsWith(''ArtifactTag'')' - message: cannot specify spec.certSecretRef when spec.type is one of - Static, AzureDevOps*, ACRArtifactTag, ECRArtifactTag or GARArtifactTag + Static, AzureDevOps*, AWSCodeCommit*, ACRArtifactTag, ECRArtifactTag + or GARArtifactTag rule: '!has(self.certSecretRef) || !(self.url == ''Static'' || self.type.startsWith(''AzureDevOps'') - || (self.type.endsWith(''ArtifactTag'') && self.type != ''OCIArtifactTag''))' - - message: cannot specify spec.secretRef when spec.type is one of Static, - ACRArtifactTag, ECRArtifactTag or GARArtifactTag - rule: '!has(self.secretRef) || !(self.url == ''Static'' || (self.type.endsWith(''ArtifactTag'') + || self.type.startsWith(''AWSCodeCommit'') || (self.type.endsWith(''ArtifactTag'') && self.type != ''OCIArtifactTag''))' + - message: cannot specify spec.secretRef when spec.type is one of Static, + AWSCodeCommit*, ACRArtifactTag, ECRArtifactTag or GARArtifactTag + rule: '!has(self.secretRef) || !(self.url == ''Static'' || self.type.startsWith(''AWSCodeCommit'') + || (self.type.endsWith(''ArtifactTag'') && self.type != ''OCIArtifactTag''))' status: description: ResourceSetInputProviderStatus defines the observed state of ResourceSetInputProvider. @@ -1327,7 +1345,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.20.0 + controller-gen.kubebuilder.io/version: v0.21.0 helm.sh/resource-policy: keep labels: app.kubernetes.io/instance: '{{ .Release.Name }}' diff --git a/packages/system/fluxcd-operator/charts/flux-operator/templates/service.yaml b/packages/system/fluxcd-operator/charts/flux-operator/templates/service.yaml index a5c73ca5f..3a8e1932c 100644 --- a/packages/system/fluxcd-operator/charts/flux-operator/templates/service.yaml +++ b/packages/system/fluxcd-operator/charts/flux-operator/templates/service.yaml @@ -13,6 +13,9 @@ metadata: {{- toYaml . | nindent 4 }} {{- end }} spec: + {{- with .Values.service.ipFamilyPolicy }} + ipFamilyPolicy: {{ . }} + {{- end }} ports: - port: 8080 targetPort: http-metrics diff --git a/packages/system/fluxcd-operator/charts/flux-operator/values.schema.json b/packages/system/fluxcd-operator/charts/flux-operator/values.schema.json index 17f4f2405..aa11fc052 100644 --- a/packages/system/fluxcd-operator/charts/flux-operator/values.schema.json +++ b/packages/system/fluxcd-operator/charts/flux-operator/values.schema.json @@ -378,6 +378,20 @@ } } }, + "service": { + "type": "object", + "properties": { + "ipFamilyPolicy": { + "type": "string", + "enum": [ + "", + "SingleStack", + "PreferDualStack", + "RequireDualStack" + ] + } + } + }, "serviceAccount": { "default": { "automount": true, diff --git a/packages/system/fluxcd-operator/charts/flux-operator/values.yaml b/packages/system/fluxcd-operator/charts/flux-operator/values.yaml index d10d6ea07..32ba30162 100644 --- a/packages/system/fluxcd-operator/charts/flux-operator/values.yaml +++ b/packages/system/fluxcd-operator/charts/flux-operator/values.yaml @@ -183,6 +183,10 @@ serviceMonitor: # @schema default: {"create":false,"interval":"60s","scrapeTimeo scrapeTimeout: 30s labels: { } +service: + # -- Sets the IP family policy on all Service resources. Uses Kubernetes defaults if unset + ipFamilyPolicy: '' # @schema type: string; enum:['', SingleStack, PreferDualStack, RequireDualStack] + # -- Marketplace settings. marketplace: type: "" diff --git a/packages/system/fluxcd/charts/flux-instance/Chart.yaml b/packages/system/fluxcd/charts/flux-instance/Chart.yaml index 9d1272ead..185a6fd4b 100644 --- a/packages/system/fluxcd/charts/flux-instance/Chart.yaml +++ b/packages/system/fluxcd/charts/flux-instance/Chart.yaml @@ -8,7 +8,7 @@ annotations: - name: Upstream Project url: https://github.com/controlplaneio-fluxcd/flux-operator apiVersion: v2 -appVersion: v0.48.0 +appVersion: v0.50.0 description: 'A Helm chart for deploying a Flux instance managed by Flux Operator. ' home: https://fluxoperator.dev icon: https://raw.githubusercontent.com/cncf/artwork/main/projects/flux/icon/color/flux-icon-color.png @@ -25,4 +25,4 @@ sources: - https://github.com/controlplaneio-fluxcd/flux-operator - https://github.com/controlplaneio-fluxcd/charts type: application -version: 0.48.0 +version: 0.50.0 diff --git a/packages/system/fluxcd/charts/flux-instance/README.md b/packages/system/fluxcd/charts/flux-instance/README.md index 50b6139ab..f747e1a1d 100644 --- a/packages/system/fluxcd/charts/flux-instance/README.md +++ b/packages/system/fluxcd/charts/flux-instance/README.md @@ -1,6 +1,6 @@ # flux-instance -![Version: 0.48.0](https://img.shields.io/badge/Version-0.48.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: v0.48.0](https://img.shields.io/badge/AppVersion-v0.48.0-informational?style=flat-square) +![Version: 0.50.0](https://img.shields.io/badge/Version-0.50.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: v0.50.0](https://img.shields.io/badge/AppVersion-v0.50.0-informational?style=flat-square) This chart is a thin wrapper around the `FluxInstance` custom resource, which is used by the [Flux Operator](https://github.com/controlplaneio-fluxcd/flux-operator) From 797284ab4f9fcd96360552d5b3d48ff1fedbc48b Mon Sep 17 00:00:00 2001 From: Myasnikov Daniil Date: Mon, 1 Jun 2026 18:47:07 +0500 Subject: [PATCH 26/28] fix(platform): preserve no-delete label when migration 43 stamps version Address review feedback from lexfrei on migrations/43: the version stamp did a label-less `kubectl create configmap | kubectl apply` under the same field manager migration 42 used, stripping the platform.cozystack.io/no-delete label and dropping cozystack-version out of the deletion-protection guardrail on every upgrade through this migration. Replace it with a labeled heredoc manifest mirroring migration 42 so the label survives the stamp. Assisted-By: Claude Signed-off-by: Myasnikov Daniil --- .../platform/images/migrations/migrations/43 | 21 ++++++++++++++++--- 1 file changed, 18 insertions(+), 3 deletions(-) diff --git a/packages/core/platform/images/migrations/migrations/43 b/packages/core/platform/images/migrations/migrations/43 index de49359b1..0c421d1fc 100755 --- a/packages/core/platform/images/migrations/migrations/43 +++ b/packages/core/platform/images/migrations/migrations/43 @@ -27,6 +27,21 @@ for ns in $(kubectl get cluster.postgresql.cnpg.io -A \ fi done -# Stamp version -kubectl create configmap -n cozy-system cozystack-version \ - --from-literal=version=44 --dry-run=client -o yaml | kubectl apply -f- +# Stamp version. +# Mirror migration 42's labeled manifest. A label-less apply by the same field +# manager (kubectl create | kubectl apply) would strip the +# platform.cozystack.io/no-delete label migration 42 added, dropping +# cozystack-version out of the cozystack-no-delete-guardrail +# ValidatingAdmissionPolicy. templates/cozystack-version.yaml only re-renders the +# labeled ConfigMap on first install, so the label must be carried inline here. +kubectl apply --filename - < Date: Mon, 1 Jun 2026 18:51:29 +0500 Subject: [PATCH 27/28] fix(kubevirt-instancetypes): retain EOL centos preferences as deprecated aliases Address review feedback from lexfrei: dropping the centos.7/centos.7.desktop/ centos.stream8{,.desktop,.dpdk} VirtualMachineClusterPreference objects hard-fails the vm-instance Helm render (vm.yaml fails when a referenced preference is absent) and makes the dynamic CRD enum reject the stored value for every existing VM on those profiles on upgrade. Re-add them as deprecated aliases in extra-instancetypes.yaml, mirroring the gn1.* GPU instancetype treatment, and extend the vm-instance enum generation to union preference names from extra-instancetypes.yaml so the retained profiles stay in values.schema.json and the RD schema. Assisted-By: Claude Signed-off-by: Myasnikov Daniil --- packages/apps/vm-instance/Makefile | 8 +- packages/apps/vm-instance/values.schema.json | 5 + .../extra-instancetypes.yaml | 155 ++++++++++++++++++ .../templates/extra-instancetypes.yaml | 155 ++++++++++++++++++ .../vm-instance-rd/cozyrds/vm-instance.yaml | 2 +- 5 files changed, 323 insertions(+), 2 deletions(-) diff --git a/packages/apps/vm-instance/Makefile b/packages/apps/vm-instance/Makefile index 92798e4f3..deaeaf207 100644 --- a/packages/apps/vm-instance/Makefile +++ b/packages/apps/vm-instance/Makefile @@ -4,6 +4,12 @@ generate: cozyvalues-gen -m 'vminstance' -v values.yaml -s values.schema.json -r README.md -g ../../../api/apps/v1alpha1/vminstance/types.go #INSTANCE_TYPES=$$(yq e '.metadata.name' -o=json -r ../../system/kubevirt-instancetypes/templates/instancetypes.yaml | yq 'split(" ") | . + [""]' -o json) \ # && yq -i -o json ".properties.instanceType.enum = $${INSTANCE_TYPES}" values.schema.json - PREFERENCES=$$(yq e '.metadata.name' -o=json -r ../../system/kubevirt-instancetypes/templates/preferences.yaml | yq 'split(" ") | . + [""]' -o json) \ + # Union the upstream preference catalog with the Cozystack-local deprecated + # aliases in extra-instancetypes.yaml, so retained EOL profiles (e.g. + # centos.7*/centos.stream8*) stay in the enum and the dynamic CRD does not + # reject existing VMInstance CRs that reference them. + PREFERENCES=$$( { yq e '.metadata.name' ../../system/kubevirt-instancetypes/templates/preferences.yaml; \ + yq e 'select(.kind == "VirtualMachineClusterPreference") | .metadata.name' ../../system/kubevirt-instancetypes/templates/extra-instancetypes.yaml; } \ + | grep -E -v -- '^(---)?$$' | sort -u | jq -R . | jq -s '. + [""]' ) \ && yq -i -o json ".properties.instanceProfile.enum = $${PREFERENCES}" values.schema.json ../../../hack/update-crd.sh diff --git a/packages/apps/vm-instance/values.schema.json b/packages/apps/vm-instance/values.schema.json index 130eba7cd..d14100999 100644 --- a/packages/apps/vm-instance/values.schema.json +++ b/packages/apps/vm-instance/values.schema.json @@ -54,8 +54,13 @@ "default": "ubuntu", "enum": [ "alpine", + "centos.7", + "centos.7.desktop", "centos.stream10", "centos.stream10.desktop", + "centos.stream8", + "centos.stream8.desktop", + "centos.stream8.dpdk", "centos.stream9", "centos.stream9.desktop", "centos.stream9.dpdk", diff --git a/packages/system/kubevirt-instancetypes/extra-instancetypes.yaml b/packages/system/kubevirt-instancetypes/extra-instancetypes.yaml index 2daf0f00e..d29a2064f 100644 --- a/packages/system/kubevirt-instancetypes/extra-instancetypes.yaml +++ b/packages/system/kubevirt-instancetypes/extra-instancetypes.yaml @@ -151,3 +151,158 @@ spec: name: gpu1 memory: guest: 16Gi +--- +# The centos.7* / centos.stream8* VirtualMachineClusterPreference objects below +# reached end-of-life and were dropped from common-instancetypes upstream, but +# existing VMInstance CRs still reference these instanceProfile names. vm.yaml +# fails the Helm render when a referenced VirtualMachineClusterPreference is +# absent (and the dynamic CRD enum would reject the stored value), so existing +# VMs on these profiles would hard-break on upgrade. They are retained here +# verbatim from the pre-removal catalog, marked deprecated, to keep those +# workloads renderable. New VMs should use a supported centos.stream9/10 profile. +apiVersion: instancetype.kubevirt.io/v1beta1 +kind: VirtualMachineClusterPreference +metadata: + annotations: + iconClass: icon-centos + openshift.io/display-name: CentOS 7 + openshift.io/documentation-url: https://github.com/kubevirt/common-instancetypes + openshift.io/provider-display-name: KubeVirt + openshift.io/support-url: https://github.com/kubevirt/common-instancetypes/issues + tags: hidden,kubevirt,linux,centos-stream + labels: + instancetype.kubevirt.io/deprecated: "true" + instancetype.kubevirt.io/os-type: linux + instancetype.kubevirt.io/vendor: kubevirt.io + name: centos.7 +spec: + annotations: + vm.kubevirt.io/os: linux + devices: + preferredDiskBus: virtio + preferredInterfaceModel: virtio + requirements: + cpu: + guest: 1 + memory: + guest: 1Gi +--- +apiVersion: instancetype.kubevirt.io/v1beta1 +kind: VirtualMachineClusterPreference +metadata: + annotations: + iconClass: icon-centos + openshift.io/display-name: CentOS 7 + openshift.io/documentation-url: https://github.com/kubevirt/common-instancetypes + openshift.io/provider-display-name: KubeVirt + openshift.io/support-url: https://github.com/kubevirt/common-instancetypes/issues + tags: hidden,kubevirt,linux,centos-stream + labels: + instancetype.kubevirt.io/deprecated: "true" + instancetype.kubevirt.io/os-type: linux + instancetype.kubevirt.io/vendor: kubevirt.io + name: centos.7.desktop +spec: + annotations: + vm.kubevirt.io/os: linux + devices: + preferredAutoattachInputDevice: true + preferredDiskBus: virtio + preferredInputBus: virtio + preferredInputType: tablet + preferredInterfaceModel: virtio + requirements: + cpu: + guest: 1 + memory: + guest: 1Gi +--- +apiVersion: instancetype.kubevirt.io/v1beta1 +kind: VirtualMachineClusterPreference +metadata: + annotations: + iconClass: icon-centos + openshift.io/display-name: CentOS Stream 8 + openshift.io/documentation-url: https://github.com/kubevirt/common-instancetypes + openshift.io/provider-display-name: KubeVirt + openshift.io/support-url: https://github.com/kubevirt/common-instancetypes/issues + tags: hidden,kubevirt,linux,centos-stream + labels: + instancetype.kubevirt.io/deprecated: "true" + instancetype.kubevirt.io/os-type: linux + instancetype.kubevirt.io/vendor: kubevirt.io + name: centos.stream8 +spec: + annotations: + vm.kubevirt.io/os: linux + devices: + preferredDiskBus: virtio + preferredInterfaceModel: virtio + requirements: + cpu: + guest: 1 + memory: + guest: 1.5Gi +--- +apiVersion: instancetype.kubevirt.io/v1beta1 +kind: VirtualMachineClusterPreference +metadata: + annotations: + iconClass: icon-centos + openshift.io/display-name: CentOS Stream 8 + openshift.io/documentation-url: https://github.com/kubevirt/common-instancetypes + openshift.io/provider-display-name: KubeVirt + openshift.io/support-url: https://github.com/kubevirt/common-instancetypes/issues + tags: hidden,kubevirt,linux,centos-stream + labels: + instancetype.kubevirt.io/deprecated: "true" + instancetype.kubevirt.io/os-type: linux + instancetype.kubevirt.io/vendor: kubevirt.io + name: centos.stream8.desktop +spec: + annotations: + vm.kubevirt.io/os: linux + devices: + preferredAutoattachInputDevice: true + preferredDiskBus: virtio + preferredInputBus: virtio + preferredInputType: tablet + preferredInterfaceModel: virtio + requirements: + cpu: + guest: 1 + memory: + guest: 1.5Gi +--- +apiVersion: instancetype.kubevirt.io/v1beta1 +kind: VirtualMachineClusterPreference +metadata: + annotations: + iconClass: icon-centos + openshift.io/display-name: CentOS Stream 8 + openshift.io/documentation-url: https://github.com/kubevirt/common-instancetypes + openshift.io/provider-display-name: KubeVirt + openshift.io/support-url: https://github.com/kubevirt/common-instancetypes/issues + tags: hidden,kubevirt,linux,centos-stream,dpdk + labels: + instancetype.kubevirt.io/deprecated: "true" + instancetype.kubevirt.io/os-type: linux + instancetype.kubevirt.io/vendor: kubevirt.io + name: centos.stream8.dpdk +spec: + annotations: + vm.kubevirt.io/os: linux + cpu: + preferredCPUTopology: spread + spreadOptions: + across: SocketsCoresThreads + ratio: 4 + devices: + preferredDiskBus: virtio + preferredInterfaceModel: virtio + preferredNetworkInterfaceMultiQueue: true + requirements: + cpu: + guest: 2 + memory: + guest: 1.5Gi diff --git a/packages/system/kubevirt-instancetypes/templates/extra-instancetypes.yaml b/packages/system/kubevirt-instancetypes/templates/extra-instancetypes.yaml index 2daf0f00e..d29a2064f 100644 --- a/packages/system/kubevirt-instancetypes/templates/extra-instancetypes.yaml +++ b/packages/system/kubevirt-instancetypes/templates/extra-instancetypes.yaml @@ -151,3 +151,158 @@ spec: name: gpu1 memory: guest: 16Gi +--- +# The centos.7* / centos.stream8* VirtualMachineClusterPreference objects below +# reached end-of-life and were dropped from common-instancetypes upstream, but +# existing VMInstance CRs still reference these instanceProfile names. vm.yaml +# fails the Helm render when a referenced VirtualMachineClusterPreference is +# absent (and the dynamic CRD enum would reject the stored value), so existing +# VMs on these profiles would hard-break on upgrade. They are retained here +# verbatim from the pre-removal catalog, marked deprecated, to keep those +# workloads renderable. New VMs should use a supported centos.stream9/10 profile. +apiVersion: instancetype.kubevirt.io/v1beta1 +kind: VirtualMachineClusterPreference +metadata: + annotations: + iconClass: icon-centos + openshift.io/display-name: CentOS 7 + openshift.io/documentation-url: https://github.com/kubevirt/common-instancetypes + openshift.io/provider-display-name: KubeVirt + openshift.io/support-url: https://github.com/kubevirt/common-instancetypes/issues + tags: hidden,kubevirt,linux,centos-stream + labels: + instancetype.kubevirt.io/deprecated: "true" + instancetype.kubevirt.io/os-type: linux + instancetype.kubevirt.io/vendor: kubevirt.io + name: centos.7 +spec: + annotations: + vm.kubevirt.io/os: linux + devices: + preferredDiskBus: virtio + preferredInterfaceModel: virtio + requirements: + cpu: + guest: 1 + memory: + guest: 1Gi +--- +apiVersion: instancetype.kubevirt.io/v1beta1 +kind: VirtualMachineClusterPreference +metadata: + annotations: + iconClass: icon-centos + openshift.io/display-name: CentOS 7 + openshift.io/documentation-url: https://github.com/kubevirt/common-instancetypes + openshift.io/provider-display-name: KubeVirt + openshift.io/support-url: https://github.com/kubevirt/common-instancetypes/issues + tags: hidden,kubevirt,linux,centos-stream + labels: + instancetype.kubevirt.io/deprecated: "true" + instancetype.kubevirt.io/os-type: linux + instancetype.kubevirt.io/vendor: kubevirt.io + name: centos.7.desktop +spec: + annotations: + vm.kubevirt.io/os: linux + devices: + preferredAutoattachInputDevice: true + preferredDiskBus: virtio + preferredInputBus: virtio + preferredInputType: tablet + preferredInterfaceModel: virtio + requirements: + cpu: + guest: 1 + memory: + guest: 1Gi +--- +apiVersion: instancetype.kubevirt.io/v1beta1 +kind: VirtualMachineClusterPreference +metadata: + annotations: + iconClass: icon-centos + openshift.io/display-name: CentOS Stream 8 + openshift.io/documentation-url: https://github.com/kubevirt/common-instancetypes + openshift.io/provider-display-name: KubeVirt + openshift.io/support-url: https://github.com/kubevirt/common-instancetypes/issues + tags: hidden,kubevirt,linux,centos-stream + labels: + instancetype.kubevirt.io/deprecated: "true" + instancetype.kubevirt.io/os-type: linux + instancetype.kubevirt.io/vendor: kubevirt.io + name: centos.stream8 +spec: + annotations: + vm.kubevirt.io/os: linux + devices: + preferredDiskBus: virtio + preferredInterfaceModel: virtio + requirements: + cpu: + guest: 1 + memory: + guest: 1.5Gi +--- +apiVersion: instancetype.kubevirt.io/v1beta1 +kind: VirtualMachineClusterPreference +metadata: + annotations: + iconClass: icon-centos + openshift.io/display-name: CentOS Stream 8 + openshift.io/documentation-url: https://github.com/kubevirt/common-instancetypes + openshift.io/provider-display-name: KubeVirt + openshift.io/support-url: https://github.com/kubevirt/common-instancetypes/issues + tags: hidden,kubevirt,linux,centos-stream + labels: + instancetype.kubevirt.io/deprecated: "true" + instancetype.kubevirt.io/os-type: linux + instancetype.kubevirt.io/vendor: kubevirt.io + name: centos.stream8.desktop +spec: + annotations: + vm.kubevirt.io/os: linux + devices: + preferredAutoattachInputDevice: true + preferredDiskBus: virtio + preferredInputBus: virtio + preferredInputType: tablet + preferredInterfaceModel: virtio + requirements: + cpu: + guest: 1 + memory: + guest: 1.5Gi +--- +apiVersion: instancetype.kubevirt.io/v1beta1 +kind: VirtualMachineClusterPreference +metadata: + annotations: + iconClass: icon-centos + openshift.io/display-name: CentOS Stream 8 + openshift.io/documentation-url: https://github.com/kubevirt/common-instancetypes + openshift.io/provider-display-name: KubeVirt + openshift.io/support-url: https://github.com/kubevirt/common-instancetypes/issues + tags: hidden,kubevirt,linux,centos-stream,dpdk + labels: + instancetype.kubevirt.io/deprecated: "true" + instancetype.kubevirt.io/os-type: linux + instancetype.kubevirt.io/vendor: kubevirt.io + name: centos.stream8.dpdk +spec: + annotations: + vm.kubevirt.io/os: linux + cpu: + preferredCPUTopology: spread + spreadOptions: + across: SocketsCoresThreads + ratio: 4 + devices: + preferredDiskBus: virtio + preferredInterfaceModel: virtio + preferredNetworkInterfaceMultiQueue: true + requirements: + cpu: + guest: 2 + memory: + guest: 1.5Gi diff --git a/packages/system/vm-instance-rd/cozyrds/vm-instance.yaml b/packages/system/vm-instance-rd/cozyrds/vm-instance.yaml index 4dff321fb..0988be411 100644 --- a/packages/system/vm-instance-rd/cozyrds/vm-instance.yaml +++ b/packages/system/vm-instance-rd/cozyrds/vm-instance.yaml @@ -8,7 +8,7 @@ spec: singular: vminstance plural: vminstances openAPISchema: |- - {"title":"Chart Values","type":"object","properties":{"external":{"description":"Enable external access from outside the cluster.","type":"boolean","default":false},"externalMethod":{"description":"Method to pass through traffic to the VM.","type":"string","default":"PortList","enum":["PortList","WholeIP"]},"externalPorts":{"description":"Ports to forward from outside the cluster.","type":"array","default":[22],"items":{"type":"integer"}},"externalAllowICMP":{"description":"Whether to accept ICMP traffic to the VM in PortList mode (preserves ping and PMTU discovery). No effect in WholeIP mode. Default true so ping behaves as users expect even when port filtering is in effect.","type":"boolean","default":true},"runStrategy":{"description":"Requested running state of the VirtualMachineInstance","type":"string","default":"Always","enum":["Always","Halted","Manual","RerunOnFailure","Once"]},"instanceType":{"description":"Virtual Machine instance type.","type":"string","default":"u1.medium"},"instanceProfile":{"description":"Virtual Machine preferences profile.","type":"string","default":"ubuntu","enum":["alpine","centos.stream10","centos.stream10.desktop","centos.stream9","centos.stream9.desktop","centos.stream9.dpdk","cirros","debian","fedora","fedora.arm64","fedora.s390x","legacy","linux","linux.efi","linux.virtiotransitional","opensuse.leap","opensuse.tumbleweed","oraclelinux","rhel.10","rhel.10.arm64","rhel.10.s390x","rhel.7","rhel.7.desktop","rhel.8","rhel.8.desktop","rhel.8.dpdk","rhel.9","rhel.9.arm64","rhel.9.desktop","rhel.9.dpdk","rhel.9.realtime","rhel.9.s390x","sles","ubuntu","windows.10","windows.10.virtio","windows.11","windows.11.virtio","windows.2k12","windows.2k12.virtio","windows.2k16","windows.2k16.virtio","windows.2k19","windows.2k19.virtio","windows.2k22","windows.2k22.virtio","windows.2k25","windows.2k25.virtio","windows.2k3","windows.2k8","windows.2k8.virtio","windows.7","windows.7.virtio","windows.xp",""]},"disks":{"description":"List of disks to attach.","type":"array","default":[],"items":{"type":"object","required":["name"],"properties":{"bus":{"description":"Disk bus type (e.g. \"sata\").","type":"string"},"name":{"description":"Disk name.","type":"string"}}}},"networks":{"description":"Networks to attach the VM to.","type":"array","default":[],"items":{"type":"object","properties":{"name":{"description":"Network attachment name.","type":"string"}}}},"subnets":{"description":"Deprecated: use networks instead.","type":"array","default":[],"items":{"type":"object","properties":{"name":{"description":"Network attachment name.","type":"string"}}}},"gpus":{"description":"List of GPUs to attach (NVIDIA driver requires at least 4 GiB RAM).","type":"array","default":[],"items":{"type":"object","required":["name"],"properties":{"name":{"description":"The name of the GPU resource to attach.","type":"string"}}}},"cpuModel":{"description":"Model specifies the CPU model inside the VMI. List of available models https://github.com/libvirt/libvirt/tree/master/src/cpu_map","type":"string","default":""},"resources":{"description":"Resource configuration for the virtual machine.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"sockets":{"description":"Number of CPU sockets (vCPU topology).","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"sshKeys":{"description":"List of SSH public keys for authentication.","type":"array","default":[],"items":{"type":"string"}},"cloudInit":{"description":"Cloud-init user data.","type":"string","default":""},"cloudInitSeed":{"description":"Seed string to generate SMBIOS UUID for the VM.","type":"string","default":""}}} + {"title":"Chart Values","type":"object","properties":{"external":{"description":"Enable external access from outside the cluster.","type":"boolean","default":false},"externalMethod":{"description":"Method to pass through traffic to the VM.","type":"string","default":"PortList","enum":["PortList","WholeIP"]},"externalPorts":{"description":"Ports to forward from outside the cluster.","type":"array","default":[22],"items":{"type":"integer"}},"externalAllowICMP":{"description":"Whether to accept ICMP traffic to the VM in PortList mode (preserves ping and PMTU discovery). No effect in WholeIP mode. Default true so ping behaves as users expect even when port filtering is in effect.","type":"boolean","default":true},"runStrategy":{"description":"Requested running state of the VirtualMachineInstance","type":"string","default":"Always","enum":["Always","Halted","Manual","RerunOnFailure","Once"]},"instanceType":{"description":"Virtual Machine instance type.","type":"string","default":"u1.medium"},"instanceProfile":{"description":"Virtual Machine preferences profile.","type":"string","default":"ubuntu","enum":["alpine","centos.7","centos.7.desktop","centos.stream10","centos.stream10.desktop","centos.stream8","centos.stream8.desktop","centos.stream8.dpdk","centos.stream9","centos.stream9.desktop","centos.stream9.dpdk","cirros","debian","fedora","fedora.arm64","fedora.s390x","legacy","linux","linux.efi","linux.virtiotransitional","opensuse.leap","opensuse.tumbleweed","oraclelinux","rhel.10","rhel.10.arm64","rhel.10.s390x","rhel.7","rhel.7.desktop","rhel.8","rhel.8.desktop","rhel.8.dpdk","rhel.9","rhel.9.arm64","rhel.9.desktop","rhel.9.dpdk","rhel.9.realtime","rhel.9.s390x","sles","ubuntu","windows.10","windows.10.virtio","windows.11","windows.11.virtio","windows.2k12","windows.2k12.virtio","windows.2k16","windows.2k16.virtio","windows.2k19","windows.2k19.virtio","windows.2k22","windows.2k22.virtio","windows.2k25","windows.2k25.virtio","windows.2k3","windows.2k8","windows.2k8.virtio","windows.7","windows.7.virtio","windows.xp",""]},"disks":{"description":"List of disks to attach.","type":"array","default":[],"items":{"type":"object","required":["name"],"properties":{"bus":{"description":"Disk bus type (e.g. \"sata\").","type":"string"},"name":{"description":"Disk name.","type":"string"}}}},"networks":{"description":"Networks to attach the VM to.","type":"array","default":[],"items":{"type":"object","properties":{"name":{"description":"Network attachment name.","type":"string"}}}},"subnets":{"description":"Deprecated: use networks instead.","type":"array","default":[],"items":{"type":"object","properties":{"name":{"description":"Network attachment name.","type":"string"}}}},"gpus":{"description":"List of GPUs to attach (NVIDIA driver requires at least 4 GiB RAM).","type":"array","default":[],"items":{"type":"object","required":["name"],"properties":{"name":{"description":"The name of the GPU resource to attach.","type":"string"}}}},"cpuModel":{"description":"Model specifies the CPU model inside the VMI. List of available models https://github.com/libvirt/libvirt/tree/master/src/cpu_map","type":"string","default":""},"resources":{"description":"Resource configuration for the virtual machine.","type":"object","default":{},"properties":{"cpu":{"description":"Number of CPU cores allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"memory":{"description":"Amount of memory allocated.","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true},"sockets":{"description":"Number of CPU sockets (vCPU topology).","pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}},"sshKeys":{"description":"List of SSH public keys for authentication.","type":"array","default":[],"items":{"type":"string"}},"cloudInit":{"description":"Cloud-init user data.","type":"string","default":""},"cloudInitSeed":{"description":"Seed string to generate SMBIOS UUID for the VM.","type":"string","default":""}}} release: prefix: vm-instance- labels: From 910b505dc30de89ea19f5f14d08828b0ef358a87 Mon Sep 17 00:00:00 2001 From: Myasnikov Daniil Date: Tue, 2 Jun 2026 11:00:45 +0500 Subject: [PATCH 28/28] fix(fluxcd): sync app.kubernetes.io/version on the tenant flux Deployment Address non-blocking review feedback from lexfrei: the flux-tenants sharded-controller Deployment carried a stale app.kubernetes.io/version: v2.7.3 while running helm-controller v1.5.0 (Flux 2.8.0). The flux-aio Makefile update target only synced the container image, so the version label drifted on every bump and make update never self-corrected. Bump the label to v2.8.0 and extend the yq patch to carry app.kubernetes.io/version from the source flux Deployment. Assisted-By: Claude Signed-off-by: Myasnikov Daniil --- internal/fluxinstall/manifests/fluxcd-tenants.yaml | 2 +- packages/core/flux-aio/Makefile | 1 + 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/internal/fluxinstall/manifests/fluxcd-tenants.yaml b/internal/fluxinstall/manifests/fluxcd-tenants.yaml index 40ed5d7b2..744fb78eb 100644 --- a/internal/fluxinstall/manifests/fluxcd-tenants.yaml +++ b/internal/fluxinstall/manifests/fluxcd-tenants.yaml @@ -5,7 +5,7 @@ metadata: labels: app.kubernetes.io/name: flux-tenants app.kubernetes.io/part-of: flux - app.kubernetes.io/version: v2.7.3 + app.kubernetes.io/version: v2.8.0 sharding.fluxcd.io/role: shard name: flux-tenants namespace: cozy-fluxcd diff --git a/packages/core/flux-aio/Makefile b/packages/core/flux-aio/Makefile index c5eb27f96..614b7f86c 100644 --- a/packages/core/flux-aio/Makefile +++ b/packages/core/flux-aio/Makefile @@ -22,3 +22,4 @@ update: -e 's|\.cluster\.local\.,||g' -e 's|\.cluster\.local\,||g' -e 's|\.cluster\.local\.||g' \ -e 's|--storage-adv-addr=source-watcher.$$(RUNTIME_NAMESPACE).svc|--storage-adv-addr=flux.$$(RUNTIME_NAMESPACE).svc|' yq eval '.spec.template.spec.containers[0].image = "'"$$(yq eval 'select(.kind == "Deployment" and .metadata.name == "flux") | .spec.template.spec.containers[] | select(.name == "helm-controller").image' $(MANIFESTS_DIR)/fluxcd.yaml)"'"' -i $(MANIFESTS_DIR)/fluxcd-tenants.yaml + yq eval '.metadata.labels."app.kubernetes.io/version" = "'"$$(yq eval 'select(.kind == "Deployment" and .metadata.name == "flux") | .metadata.labels."app.kubernetes.io/version"' $(MANIFESTS_DIR)/fluxcd.yaml)"'"' -i $(MANIFESTS_DIR)/fluxcd-tenants.yaml