mirror of
https://github.com/cozystack/cozystack.git
synced 2026-11-02 18:16:53 +09:00
Aleksei Sviridkin
29bf56f550
## What this PR does Bumps three of the small components listed in #2900, each picking up published security fixes: - **opencost** chart `1.41.0 → 2.5.23` (app `1.111.0 → 1.120.3`). The 1.x→2.x chart-major bump's values schema is additive, so the cozystack overrides (external prometheus vmselect endpoint, customPricing) stay valid. The Makefile now pins `--version 2.5.23` and drops the upstream snapshot test suite (it can't resolve in the cozystack render context); cozystack ships its own helm-unittest. - **multus-cni** `v4.2.3 → v4.3.0`, rebuilt multi-arch (builder `golang:1.24 → 1.26` for the Go-stdlib CVEs). This also **folds the `multusMasterCNI: 05-cilium.conflist` CNI-ordering fix into `customize-deployment.patch`** — it was previously a raw daemonset hand-edit that the next `make update` would have wiped, re-introducing the kube-ovn-before-cilium startup race. A new helm-unittest pins it. - **clickhouse-backup tool** `altinity/clickhouse-backup 2.6.32 → 2.7.2`, rebuilt multi-arch. The separate `clickhouse-backup` image (clickhouse-server base) and the managed clickhouse-server version are intentionally left as-is (multi-major server upgrade, out of scope). Each package gains helm-unittest coverage (none shipped before). **Deferred from #2900 (this PR does NOT close the issue):** - **bootbox** — already at the latest upstream tag (no-op). - **kubeovn-plunger** — first-party cozystack component, no upstream release to bump. - **etcd-operator** — held at 0.4.5: the 0.5.x Helm chart is not published on the `ghcr.io/aenix-io/charts` OCI registry yet (only GitHub releases exist), so `helm pull` can't fetch it. Needs an aenix-io chart publish first. - **ingress-nginx** — deliberately pinned to 4.11.2 (revert `5c900a746` after the CVE-2025-1974 mitigation attempt); bumping needs a separate investigation, not a routine sweep. ### Release note ```release-note chore(images): bump opencost to 2.5.23, multus-cni to v4.3.0, and clickhouse-backup to 2.7.2 ``` <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Enhanced OpenCost Helm support for plugin installation/config validation, cloud integration (secret or JSON), MCP server, and `extraObjects` rendering * Added admin token secret creation and Pod Disruption Budget options * Expanded UI/API/MCP exposure via Ingress, OpenShift Route, and Gateway API HTTPRoute * Improved internal Prometheus/Thanos endpoint handling and optional CA trust update * **Updates** * Updated ClickHouse backup and Multus images; adjusted Multus “thick” deployment behavior/resources and namespace usage * Refreshed OpenCost chart values/docs and bumped chart/app versions * **Tests** * Added/extended Helm unittest suites and rendering invariants for backup, Multus, and OpenCost <!-- end of auto-generated comment: release notes by coderabbit.ai -->