cozystack/docs/changelogs/v1.1.3.md

Fixes

• [kubernetes] Fix CiliumNetworkPolicy endpointSelector not updated for multi-node RWX volumes: When an NFS-backed RWX volume was published to multiple VMs, the CiliumNetworkPolicy endpointSelector.matchLabels was set only for the first VM and never broadened on subsequent ControllerPublishVolume calls. This caused Cilium to block NFS egress so that mounts hung on all nodes except the first. The selector now uses matchExpressions with operator: In and is rebuilt whenever owner references are added or removed (@mattia-eleuteri in #2227, #2229).

• [dashboard] Fix dashboard-client secret desynchronization with Keycloak after upgrades: When the dashboard-client Kubernetes Secret was recreated with a new value after an upgrade or reinstall, the KeycloakClient spec remained unchanged and the EDP Keycloak operator skipped reconciliation, leaving Keycloak with the stale secret and causing authentication failures for the dashboard. A secret-hash annotation containing the SHA256 hash of the client secret is now added to the KeycloakClient resource; any secret rotation updates the hash in metadata, triggering operator reconciliation and syncing the new secret to Keycloak (@sircthulhu in #2231, #2241).

• [etcd] Fix defrag CronJob accumulating hundreds of pods during cluster upgrades: After upgrading CozyStack, the etcd defrag CronJob could accumulate hundreds of running and failed pods when etcd was temporarily unavailable during the upgrade, because no concurrency or retry limits were configured. Added concurrencyPolicy: Forbid to prevent parallel jobs, startingDeadlineSeconds: 300 to discard missed schedules older than 5 minutes, failedJobsHistoryLimit: 1 to limit failure retention, activeDeadlineSeconds: 1800 for a 30-minute per-job timeout, and backoffLimit: 2 to cap retries (@sircthulhu in #2233, #2234).

Documentation

• [website] Document keycloakInternalUrl platform value: Added reference documentation for the authentication.oidc.keycloakInternalUrl platform value to the Platform Package Reference, Self-Signed Certificates guide, and Enable OIDC Server guide, explaining how to route dashboard backend OIDC requests through the internal Keycloak service URL (@sircthulhu in cozystack/website#452).

---

Full Changelog: https://github.com/cozystack/cozystack/compare/v1.1.2...v1.1.3