Aleksei Sviridkin d060ebdefe feat(cozystack-controller): grant the GPU controller its writes ...

The binder writes finalizers and status on GPU classes, devices and
nodes, deletes template devices with their VMI, and deletes the
unscheduled VMI of a device that must leave its node; the admission
webhook in the same binary creates template devices.

The settings ConfigMap is the only ConfigMap the controller writes, so
its rights live in a Role in cozy-system rather than the ClusterRole:
get, update and patch are scoped to that object by name, and create,
which RBAC cannot scope by name, is scoped by the namespace.

With --metrics-secure the metrics endpoint authenticates and authorizes
each scrape through TokenReview and SubjectAccessReview, so the
controller needs create on both for the GPU metrics to be scraped.

Signed-off-by: Aleksei Sviridkin <f@lex.la>
Assisted-by: LLM

2026-10-21 05:24:05 +03:00

..

application-definition-crd

docs(api): separate the healthCheckExprs failure modes

2026-09-23 00:05:35 +03:00

backup-controller

build(images): fall back to direct and retry Go module downloads

2026-10-01 19:37:00 +03:00

backupstrategy-controller

test(backups): fail CI on any default Strategy CR rendered without its CRD gate

2026-10-14 13:31:48 +00:00

bootbox

…

bootbox-rd

…

bucket

feat(bucket): add a ui flag to skip the s3manager web UI

2026-10-12 13:09:23 +02:00

bucket-rd

feat(bucket): add a ui flag to skip the s3manager web UI

2026-10-12 13:09:23 +02:00

capi-operator

…

capi-providers-bootstrap

…

capi-providers-core

fix(capi): ship the core provider manifests the repository actually holds

2026-09-25 16:26:13 +02:00

capi-providers-cpprovider

ci(build): fall back to direct, retry and cache Go module downloads (#4660)

2026-10-05 14:14:47 +03:00

capi-providers-infraprovider

build(images): fall back to direct and retry Go module downloads

2026-10-01 19:37:00 +03:00

capi-providers-infraprovider-proxmox

feat(cluster-api): add Proxmox infrastructure provider package

2026-09-25 16:23:45 +02:00

capi-providers-ipam-in-cluster

feat(cluster-api): add in-cluster IPAM provider package

2026-09-25 16:23:45 +02:00

cert-manager

fix(cert-manager): enable the Gateway API solver in the controller

2026-10-07 14:14:35 +03:00

cert-manager-crds

test(cert-manager-crds): pin the keep annotation on the CRDs

2026-08-07 14:36:06 +03:00

cert-manager-issuers

fix(platform): declare the injected _cluster values in system charts

2026-09-07 02:23:47 +03:00

cilium

feat(gateway)!: reserve a passthrough listener's name by the spec alone (#4638)

2026-10-10 16:59:17 +03:00

cilium-networkpolicy

fix(cilium): deny world ingress to etcd's HTTP port on Talos v1.14

2026-09-30 04:23:38 +03:00

clickhouse-operator

…

clickhouse-rd

feat(clickhouse): add configurable version parameter

2026-08-24 23:41:27 +03:00

cluster-autoscaler

…

clustersecret-operator

…

computeplane-rd

docs(computeplane): nodeGroups allowlist drops unlisted fields, not pass-through

2026-08-25 16:39:19 +03:00

coredns

…

cozy-proxy

feat(cozy-proxy): update to v0.4.0 with arm64 images

2026-09-28 21:41:31 +03:00

cozystack-api

fix(api): leave failed golden images out of the image options (#4568)

2026-10-05 15:14:25 +03:00

cozystack-basics

feat(redis)!: refuse external access without TLS at admission (#4639)

2026-10-06 16:39:23 +03:00

cozystack-controller

feat(cozystack-controller): grant the GPU controller its writes

2026-10-21 05:24:05 +03:00

cozystack-scheduler

feat(cozystack-scheduler): update to v0.4.0 with arm64 images

2026-09-28 21:41:32 +03:00

dashboard

feat(dashboard): show categories brought by tapped repositories in the sidebars (#4741)

2026-10-11 18:56:38 +03:00

etcd-operator

fix(etcd-operator): gate VMServiceScrape on VictoriaMetrics operator CRD (#3960)

2026-10-07 16:54:10 +04:00

etcd-operator-crds

chore(etcd-operator): bump to v0.5.6

2026-09-23 21:22:43 +04:00

etcd-rd

docs(etcd): note that affinity is not applied to existing members

2026-09-01 12:47:46 +03:00

external-dns

…

external-dns-rd

…

external-secrets-operator

fix(external-secrets): move the webhook off the kubelet's port

2026-07-20 04:49:57 +03:00

flux-plunger

build(images): fall back to direct and retry Go module downloads

2026-10-01 19:37:00 +03:00

flux-shard-operator

build(images): fall back to direct and retry Go module downloads

2026-10-01 19:37:00 +03:00

forklift

feat(migration): tenant self-service VM import from VMware vSphere

2026-09-07 17:03:44 +02:00

forklift-operator

feat(migration): tenant self-service VM import from VMware vSphere

2026-09-07 17:03:44 +02:00

foundationdb-operator

fix(foundationdb-operator)!: drop the amd64-only 7.1 init container

2026-09-26 20:30:50 +03:00

foundationdb-rd

…

gateway-api-crds

test(gateway-api-crds): pin the vendored bundle version in the suite

2026-09-03 22:17:04 +03:00

goldpinger

…

gpu-operator

feat(kubernetes): default gpu-operator to an OS-provided driver on Talos

2026-09-29 17:09:13 +02:00

grafana-operator

chore(deps): update container image & action digests

2026-09-24 16:55:04 +03:00

hami

…

harbor

build(images): fall back to direct and retry Go module downloads

2026-10-01 19:37:00 +03:00

harbor-rd

docs(harbor): say what managementWhitelist overrides and trusts

2026-09-24 15:53:00 +03:00

hetzner-robotlb

chore(hetzner-robotlb): update robotlb to 0.1.0

2026-09-29 10:50:55 +05:00

info-rd

…

ingress-nginx

docs(cilium): re-anchor comments the v1.20.2 bump made stale

2026-10-09 02:04:40 +03:00

ingress-rd

…

kafka-operator

fix(kafka-operator): size the operator JVM from its container limits

2026-10-11 12:39:37 +03:00

kafka-rd

feat(apps): declare the Kubernetes and Kafka name caps in their charts

2026-09-23 10:59:51 +03:00

kamaji

fix(kamaji): drop any subchart nested under the vendored kamaji chart (#4459)

2026-10-05 15:14:48 +03:00

keda

chore: drop private cluster, host and personal names from the tree

2026-10-07 04:38:06 +03:00

keycloak

feat(keycloak): expose zone placement for the keycloak-db instances

2026-10-11 00:32:54 +02:00

keycloak-configure

test(keycloak): pin organizationsEnabled rendering in configure-kk

2026-09-29 17:10:10 +02:00

keycloak-operator

ci(build): fall back to direct, retry and cache Go module downloads (#4660)

2026-10-05 14:14:47 +03:00

kilo

ci(build): fall back to direct, retry and cache Go module downloads (#4660)

2026-10-05 14:14:47 +03:00

kubeovn

ci(build): fall back to direct, retry and cache Go module downloads (#4660)

2026-10-05 14:14:47 +03:00

kubeovn-plunger

build(images): fall back to direct and retry Go module downloads

2026-10-01 19:37:00 +03:00

kubeovn-webhook

docs(cilium): re-anchor comments the v1.20.2 bump made stale

2026-10-09 02:04:40 +03:00

kubernetes-nodes-rd

feat(kubernetes-nodes): build the Proxmox worker template from the pool's Talos values

2026-10-11 01:23:10 +02:00

kubernetes-rd

fix(dashboard, kubernetes): declare the no-enable-switch addons and harden the focus helper

2026-10-07 05:04:06 +03:00

kubernetes-worker-image

fix(kubernetes-worker-image): wait for goldens to import before Ready

2026-09-29 22:15:59 +03:00

kuberture

fix(build): name the repository of the keda and kuberture pins

2026-09-27 07:57:31 +03:00

kubevirt

fix(kubevirt): route the export proxy to the Service KubeVirt creates (#4637)

2026-10-07 11:19:32 +03:00

kubevirt-cdi

fix(cdi): validate kubevirt-cdi values against a schema (#4417)

2026-09-23 20:07:06 +04:00

kubevirt-cdi-operator

fix(vm-disk)!: refuse a golden-image clone CDI would leave unbound

2026-10-10 21:16:11 +03:00

kubevirt-csi-node

fix(kubernetes): pin KubeVirt CSI sidecars to SIG Storage releases

2026-08-21 15:51:53 +03:00

kubevirt-instancetypes

…

kubevirt-operator

test(kubevirt): add a unit-test target for the operator package

2026-09-07 01:23:29 +03:00

lineage-controller-webhook

build(images): fall back to direct and retry Go module downloads

2026-10-01 19:37:00 +03:00

linstor

fix(linstor): mark volumes restored from a snapshot DRBD-initialized (#4866)

2026-10-12 17:25:22 +03:00

linstor-gui

chore: drop private cluster, host and personal names from the tree

2026-10-07 04:38:06 +03:00

linstor-scheduler

test(tests): fail absence-only cases when the template renders nothing

2026-10-01 22:27:17 +03:00

local-ccm

…

local-storage

feat(local-storage): add opt-in OpenEBS LocalPV hostpath package

2026-10-07 11:30:45 +03:00

mariadb-operator

fix(mariadb): correct webhook cert-manager override key path

2026-09-28 17:41:20 +05:30

mariadb-rd

feat(mariadb)!: generate every user password, root included

2026-09-24 18:10:57 +03:00

metallb

fix(build): pass the shared buildx flags from every image target

2026-09-26 14:32:44 +03:00

metrics-server

fix(metrics-server): move the listener off the kubelet's port

2026-07-20 05:24:04 +03:00

migration-controller

build(images): fall back to direct and retry Go module downloads

2026-10-01 19:37:00 +03:00

mongodb-operator

…

mongodb-rd

fix(mongodb): apply the storage once per job, and pin the terms that decide ownership

2026-09-29 10:14:44 +04:00

monitoring

fix(monitoring): send alerts to every Alertmanager replica

2026-10-12 19:45:24 +03:00

monitoring-agents

fix: typo in monitoring-agents values.yaml

2026-10-10 22:38:07 +03:00

monitoring-rd

fix(monitoring): count a central request as the receiver admitted it

2026-10-06 09:39:04 +03:00

multus

feat(platform): pass multus resources from networking.multus.resources

2026-10-10 20:59:26 +03:00

nats

…

nats-rd

feat(nats): publish ca.crt-only trust anchor to tenants

2026-08-12 18:42:13 +03:00

nfs-driver

…

objectstorage-controller

ci(build): fall back to direct, retry and cache Go module downloads (#4660)

2026-10-05 14:14:47 +03:00

openbao

…

openbao-rd

fix(openbao): constrain the seal values that reach the server config

2026-10-08 22:39:10 +03:00

opencost

…

opensearch-operator

ci(build): fall back to direct, retry and cache Go module downloads (#4660)

2026-10-05 14:14:47 +03:00

opensearch-rd

feat(opensearch)!: issue the HTTP API certificate from cert-manager

2026-09-11 01:23:13 +03:00

ouroboros

test(system): anchor index-addressed negative asserts to what they name

2026-08-12 15:28:37 +03:00

piraeus-operator

fix(linstor): use severity warning instead of warn in piraeus-datastore alerts

2026-09-30 13:53:06 +03:00

piraeus-operator-crds

…

postgres-operator

fix(postgres-operator): count every scraped empty queue in the WAL backlog rule

2026-09-30 11:11:03 +03:00

postgres-rd

fix(postgres)!: refuse plaintext sessions on external instances

2026-10-11 00:26:22 +05:00

prometheus-operator-crds

fix(prometheus-operator-crds): keep the CRDs on uninstall

2026-08-07 14:37:46 +03:00

proxmox-csi

feat(kubernetes): add the Proxmox CSI driver, with its controller in this cluster

2026-09-29 21:04:05 +02:00

qdrant

…

qdrant-rd

feat(qdrant): publish ca.crt-only trust anchor to tenants

2026-08-09 21:06:46 +03:00

rabbitmq-operator

fix(rabbitmq): bound the topology operator Secret cache

2026-09-29 17:08:17 +02:00

rabbitmq-rd

fix(rabbitmq): describe the preset as filling what resources leaves unset

2026-09-22 17:47:55 +04:00

redis-operator

fix(redis): re-send the Sentinel auth-pass when the operator resets a Sentinel

2026-10-10 01:18:13 +05:00

redis-rd

feat(redis): expose min-replicas-to-write and min-replicas-max-lag

2026-10-12 02:03:17 +05:00

reloader

fix(reloader): add startupProbe to survive slow first start under load

2026-07-28 12:16:57 +03:00

seaweedfs

build(seaweedfs): stamp the re-pinned in-tree image

2026-10-13 16:22:45 +03:00

seaweedfs-db

…

seaweedfs-rd

fix(seaweedfs): raise the number of buckets a volume server can serve

2026-09-17 00:54:48 +03:00

securitygroup-controller

build(images): fall back to direct and retry Go module downloads

2026-10-01 19:37:00 +03:00

snapshot-controller

…

talos-log-collector

chore(deps): update container image & action digests

2026-09-24 16:55:04 +03:00

tcp-balancer-rd

docs(tcp-balancer): say that whitelistHTTP needs a non-empty whitelist

2026-09-23 11:18:19 +04:00

telepresence

…

tenant-rd

fix(monitoring): count a central request as the receiver admitted it

2026-10-06 09:39:04 +03:00

valkey-rd

feat(valkey): register Valkey application in the platform

2026-09-01 11:43:10 +04:00

velero

fix(velero): bump velero-plugin-for-aws to v1.14.4 so backups work on R2

2026-10-10 01:18:13 +05:00

vertical-pod-autoscaler

test(tests): fail absence-only cases when the template renders nothing

2026-10-01 22:27:17 +03:00

vertical-pod-autoscaler-crds

fix(vertical-pod-autoscaler-crds): keep the CRDs on uninstall

2026-08-07 14:37:46 +03:00

victoria-metrics-operator

…

virtualprivatecloud-rd

feat(vpc): expose allowSubnets per subnet

2026-09-29 18:47:18 +03:00

vm-default-images

fix(vm-default-images): wait for golden images to import before Ready

2026-09-29 22:15:58 +03:00

vm-disk-rd

fix(vm-disk): keep the Helm install from waiting on the DataVolume

2026-10-02 14:01:13 +03:00

vm-instance-rd

fix(vm-instance): make the netplan network-data opt-in

2026-10-06 16:11:33 +03:00

vpn-rd

…

vsnap-crd

fix(vsnap-crd): keep the CRDs when the release is uninstalled

2026-08-07 14:37:46 +03:00

.gitattributes

chore(codeowners): don't gate per-app generated files on architect review

2026-08-03 14:08:36 +03:00

Makefile

…