Introduces a new opt-in system package that provisions an admin-facing
GitOps surface: a Flux GitRepository + Kustomization in cozy-system
reconciling an admin-owned git repo of cluster customizations via a
curated ServiceAccount.
The admin uses this to manage Package CR patches (e.g. OIDC enable,
MetalLB option overrides) and bring their own HelmReleases / Keycloak
realm imports / NetworkPolicies as code in a repo they own, rather
than via in-cluster kubectl patch.
Wired into the platform chart via a single `customizer.enabled` flag
in values; off by default. When enabled, emits the cozystack.customizer
Package CR through the existing bundles/system.yaml path and respects
bundles.disabledPackages.
Curated ClusterRole grants patch (not delete) on packages.cozystack.io,
read-only on platform HelmReleases, full ownership of PackageSources +
admin-owned namespaces (default: cozy-customizer), and Keycloak realm
CRs. Explicitly does NOT grant delete on Packages, anything on CRDs,
the cozystack-controller Deployment, or kube-system.
NOTE: this MVP ships the GitOps surface only. The field-ownership
contract documented in the package values is currently advisory; a
validating admission webhook on packages.cozystack.io is the planned
enforcement (kustomize-controller hardcodes client.ForceOwnership on
Apply, so SSA conflict detection cannot block silent ownership
transfer at the Flux layer). Risk callout is inline in the values
block.
Includes helm-unittest coverage for the bundle wiring (off, on with
values, disabledPackages override).
Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
Adds publishing.proxyProtocol on the platform values: a single flag
that both turns PROXY-protocol on at the host ingress-nginx (via the
ingress-application Package CR's component values dict) and emits the
new cozystack.ouroboros Package CR for the host install. The two
pieces are coupled by design — turning PROXY-protocol on at
ingress-nginx without ouroboros breaks intra-cluster traffic to the
cluster's own public hostnames (kube-proxy / Cilium-KPR short-circuits
the LB IP, the connection arrives at ingress-nginx without the PROXY
header it now requires, and ingress-nginx closes the connection).
The new sources/ouroboros.yaml PackageSource declares the host chart
with dependsOn: cozystack.networking + cozystack.ingress-application
so install ordering is deterministic. The bundle template emits the
host ouroboros Package via the standard helper — the parent chart's
Gateway-API watching default of false stays in place, because cozystack
does not install Gateway-API CRDs cluster-wide on the host (system/
gateway-api-crds is referenced only from the kubernetes-application
PackageSource, tenant scope). Forcing --gateway-api on a host without
the CRDs would CrashLoop the controller on WaitForCacheSync against
missing GVRs.
The flag default is false. Clusters that do not run PROXY-protocol get
zero new resources, zero RBAC delta, zero behaviour change.
Disabling: flipping publishing.proxyProtocol back to false stops
emitting the cozystack.ouroboros Package CR, but every Package CR
carries helm.sh/resource-policy: keep — Helm leaves the existing
Package on the cluster so ouroboros stays installed and the live
Corefile rewrite block keeps pointing at the still-running
ouroboros-proxy Service. Flag-flip alone is idempotent and safe. To
actually uninstall ouroboros the operator removes the Package CR
explicitly (or adds the package name to bundles.disabledPackages) and
runs the documented Corefile cleanup recipe in the same window —
otherwise stale rewrites point at a deleted Service and in-cluster
DNS for hairpinned hostnames returns connection-refused. The values
comment ships the cleanup recipe (a JSON merge-patch on data.Corefile
that strips the BEGIN/END block while preserving labels, annotations,
and other data keys including any Talos-managed metadata) and
documents the upstream-LB precondition (the L4 LB in front of
ingress-nginx must already be injecting PROXY-v1 headers before the
flag flips on), the host-vs-tenant fan-out (the flag does not cascade
into tenant clusters; tenants opt in per-Kubernetes-CR via
addons.ouroboros.enabled), and the Talos re-render flap window
(machine-config pushes wipe the BEGIN/END markers; the controller
re-applies on next reconcile, ≤10 minutes by default).
Also drops the stale "distro-full" entry from the bundles.system.variant
options comment in core/platform/values.yaml — the variant was removed
in v1.0.1 and was never restored.
Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
Myasnikov Daniil