Aleksei Sviridkin 69247ba80c feat(platform): deploy the securitygroup-controller ...

Add the securitygroup-controller Helm package (Deployment, ServiceAccount,
ClusterRole and binding, image build) and register it as a default system
package so it ships with the platform.

The ClusterRole grants cluster-wide pod patch — the controller stamps the
SecurityGroup membership label on managed-app pods across dynamically-created
tenant namespaces, so the grant cannot be namespace-scoped — plus read and
finalizer patch on the backing CiliumNetworkPolicies, and leader-election
leases. Tenants gain no new permissions; the membership label is written
exclusively by this platform controller. helm-unittest pins the pod-patch and
ciliumnetworkpolicies grants so a dropped verb fails the suite rather than
silently failing closed at runtime.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>

2026-06-25 17:50:33 +03:00

..

application-definition-crd

refactor(api): rename CozystackResourceDefinition to ApplicationDefinition

2026-01-15 22:35:56 +01:00

backup-controller

refactor(build): mode=max registry cache with a main-only warmer (#2938)

2026-06-18 10:40:05 +05:00

backupstrategy-controller

refactor(build): mode=max registry cache with a main-only warmer (#2938)

2026-06-18 10:40:05 +05:00

bootbox

refactor(labels): remove cozystack.io/ui label

2026-01-19 13:59:29 +01:00

bootbox-rd

[docs] Updated app go types

2026-03-25 15:57:25 +05:00

bucket

ci: consolidated platform & e2e stabilization batch (#2948)

2026-06-22 09:19:22 +05:00

bucket-rd

chore(apps): regenerate schemas and ApplicationDefinitions with x-cozystack-options

2026-06-02 16:42:58 +03:00

capi-operator

refactor: move scripts to hack directory

2026-01-15 16:06:56 +01:00

capi-providers-bootstrap

fix(cluster-api): fix kamaji OOM and set limits on unset providers

2026-05-21 12:57:02 +05:00

capi-providers-core

fix(capi): add startupProbe to capi-controller-manager to survive cert provisioning delay (#2946)

2026-06-18 10:40:05 +05:00

capi-providers-cpprovider

fix(cluster-api): fix kamaji OOM and set limits on unset providers

2026-05-21 12:57:02 +05:00

capi-providers-infraprovider

fix(cluster-api): fix kamaji OOM and set limits on unset providers

2026-05-21 12:57:02 +05:00

cert-manager

fix(cert-manager): bump chart to v1.20.2

2026-05-03 20:49:47 +05:00

cert-manager-crds

fix(cert-manager): bump chart to v1.20.2

2026-05-03 20:49:47 +05:00

cert-manager-issuers

feat(platform): add deletion-protection guardrail via ValidatingAdmissionPolicy

2026-05-26 14:18:22 +05:00

cilium

refactor(build): mode=max registry cache with a main-only warmer (#2938)

2026-06-18 10:40:05 +05:00

cilium-networkpolicy

chore(metallb): bump to v0.16.1 and rotate host-network port denylist

2026-05-29 11:07:19 +03:00

clickhouse-operator

refactor: move scripts to hack directory

2026-01-15 16:06:56 +01:00

clickhouse-rd

chore(apps): regenerate schemas and ApplicationDefinitions with x-cozystack-options

2026-06-02 16:42:58 +03:00

cluster-autoscaler

feat(cluster-autoscaler): enable enforce-node-group-min-size by default

2026-02-14 11:42:52 +01:00

clustersecret-operator

Add clustersecret-operator system package

2026-02-10 22:47:20 +05:00

coredns

fix(coredns): sanitize Chart.Version build metadata in coredns-custom label

2026-05-07 16:45:36 +03:00

cozy-proxy

feat(cozy-proxy): bump to v0.3.0

2026-04-28 11:14:27 +02:00

cozystack-api

feat(cozystack-api): register sdn APIService and SecurityGroup RBAC

2026-06-22 16:35:10 +03:00

cozystack-basics

feat(cozystack-api): register sdn APIService and SecurityGroup RBAC

2026-06-22 16:35:10 +03:00

cozystack-controller

ci: consolidated platform & e2e stabilization batch (#2948)

2026-06-22 09:19:22 +05:00

cozystack-scheduler

feat(scheduler): storage-aware scheduling

2026-04-13 17:15:09 +03:00

dashboard

ci: consolidated platform & e2e stabilization batch (#2948)

2026-06-22 09:19:22 +05:00

etcd-operator

feat(platform): add implementation of backup-strategy controller for etcd

2026-05-22 14:35:08 +04:00

etcd-rd

feat(platform): add implementation of backup-strategy controller for etcd

2026-05-22 14:35:08 +04:00

external-dns

feat(extra): add external-dns as standalone extra package

2026-03-10 12:48:01 +01:00

external-dns-rd

ci(external-dns): regenerate cozyrds schema for gatewayAPI description

2026-05-25 19:11:52 +03:00

external-secrets-operator

refactor: move scripts to hack directory

2026-01-15 16:06:56 +01:00

flux-plunger

refactor(build): mode=max registry cache with a main-only warmer (#2938)

2026-06-18 10:40:05 +05:00

flux-shard-operator

docs(flux-shard-operator): align parameter table columns

2026-06-22 10:03:02 +05:00

fluxcd

feat(fluxcd): bump flux-operator/flux-instance charts to v0.50.0

2026-05-31 19:04:20 +05:00

fluxcd-operator

feat(fluxcd): bump flux-operator/flux-instance charts to v0.50.0

2026-05-31 19:04:20 +05:00

foundationdb-operator

refactor: move scripts to hack directory

2026-01-15 16:06:56 +01:00

foundationdb-rd

chore(apps): regenerate schemas and ApplicationDefinitions with x-cozystack-options

2026-06-02 16:42:58 +03:00

gateway-api-crds

feat: Gateway API support via Cilium

2026-05-25 17:07:02 +03:00

goldpinger

refactor: move scripts to hack directory

2026-01-15 16:06:56 +01:00

gpu-operator

feat(gpu-operator): add container variant for preinstalled host driver

2026-06-08 16:58:51 +03:00

grafana-operator

refactor(build): mode=max registry cache with a main-only warmer (#2938)

2026-06-18 10:40:05 +05:00

hami

chore(hami): document and partially automate vendor patches in Makefile

2026-04-29 11:14:41 +03:00

harbor

test(harbor): add helm-unittest coverage for bucket-secret guards

2026-04-30 16:40:26 +05:00

harbor-rd

chore(apps): regenerate schemas and ApplicationDefinitions with x-cozystack-options

2026-06-02 16:42:58 +03:00

hetzner-robotlb

chore(hetzner-robotlb): update robotlb chart to appVersion 0.0.6

2026-04-23 16:57:23 +05:00

http-cache-rd

chore(apps): regenerate schemas and ApplicationDefinitions with x-cozystack-options

2026-06-02 16:42:58 +03:00

info-rd

refactor(labels): remove cozystack.io/ui label

2026-01-19 13:59:29 +01:00

ingress-nginx

Replaced direct chart edits with patch files

2026-03-02 12:35:14 +05:00

ingress-rd

feat(ingress): add proxyProtocol knob to ingress-nginx

2026-06-09 12:50:35 +03:00

kafka-operator

refactor: move scripts to hack directory

2026-01-15 16:06:56 +01:00

kafka-rd

chore(apps): regenerate schemas and ApplicationDefinitions with x-cozystack-options

2026-06-02 16:42:58 +03:00

kamaji

refactor(build): mode=max registry cache with a main-only warmer (#2938)

2026-06-18 10:40:05 +05:00

keycloak

fix(ingress): keep tls section in operator wildcard mode

2026-06-10 03:18:42 +03:00

keycloak-configure

chore(keycloak): use generic example values in chart comments

2026-05-12 13:13:19 +05:00

keycloak-operator

refactor(build): mode=max registry cache with a main-only warmer (#2938)

2026-06-18 10:40:05 +05:00

kilo

refactor(build): mode=max registry cache with a main-only warmer (#2938)

2026-06-18 10:40:05 +05:00

kubeovn

fix(kube-ovn): bump kube-ovn to v1.15.10 with port-group regression fix

2026-04-21 20:09:19 +02:00

kubeovn-plunger

refactor(build): mode=max registry cache with a main-only warmer (#2938)

2026-06-18 10:40:05 +05:00

kubeovn-webhook

refactor(build): mode=max registry cache with a main-only warmer (#2938)

2026-06-18 10:40:05 +05:00

kubernetes-rd

chore(apps): regenerate schemas and ApplicationDefinitions with x-cozystack-options

2026-06-02 16:42:58 +03:00

kuberture

test(kuberture): pin shim contract with helm-unittest

2026-05-14 16:49:00 +03:00

kubevirt

fix(kubevirt): reinsert each GPU CR patch independently in make update

2026-06-08 17:15:00 +03:00

kubevirt-cdi

feat: Gateway API support via Cilium

2026-05-25 17:07:02 +03:00

kubevirt-cdi-operator

fix(kubevirt-cdi-operator): add startupProbe to survive slow leader election

2026-05-25 11:54:45 +05:00

kubevirt-csi-node

Prepare release v1.4.0-rc.2

2026-05-13 21:48:39 +00:00

kubevirt-instancetypes

fix(kubevirt-instancetypes): retain EOL centos preferences as deprecated aliases

2026-06-01 18:51:29 +05:00

kubevirt-operator

fix(kubevirt-operator): move PrometheusRule to Helm-rendered template (#2543)

2026-05-04 20:38:44 +02:00

lineage-controller-webhook

refactor(build): mode=max registry cache with a main-only warmer (#2938)

2026-06-18 10:40:05 +05:00

linstor

refactor(build): mode=max registry cache with a main-only warmer (#2938)

2026-06-18 10:40:05 +05:00

linstor-gui

ci: consolidated platform & e2e stabilization batch (#2948)

2026-06-22 09:19:22 +05:00

linstor-scheduler

feat(scheduler): storage-aware scheduling

2026-04-13 17:15:09 +03:00

local-ccm

Update local-ccm v0.3.0

2026-02-10 20:19:03 +01:00

mariadb-operator

refactor: move scripts to hack directory

2026-01-15 16:06:56 +01:00

mariadb-rd

chore(apps): regenerate schemas and ApplicationDefinitions with x-cozystack-options

2026-06-02 16:42:58 +03:00

metallb

test(metallb): assert digest-pinned image form, not exact version literal (#2873)

2026-06-18 10:40:06 +05:00

metrics-server

refactor: move scripts to hack directory

2026-01-15 16:06:56 +01:00

mongodb-operator

Fix pre-commit check

2026-01-20 03:24:32 +01:00

mongodb-rd

chore(apps): regenerate schemas and ApplicationDefinitions with x-cozystack-options

2026-06-02 16:42:58 +03:00

monitoring

ci: consolidated platform & e2e stabilization batch (#2948)

2026-06-22 09:19:22 +05:00

monitoring-agents

fix(monitoring): set VPA updateMode to Initial to stop install-time eviction churn

2026-06-18 12:57:23 +05:00

monitoring-rd

[docs] Updated app go types

2026-03-25 15:57:25 +05:00

multus

refactor(build): mode=max registry cache with a main-only warmer (#2938)

2026-06-18 10:40:05 +05:00

nats

Add monitoring for NATs

2026-02-17 22:54:12 +01:00

nats-rd

chore(apps): regenerate schemas and ApplicationDefinitions with x-cozystack-options

2026-06-02 16:42:58 +03:00

nfs-driver

refactor: move scripts to hack directory

2026-01-15 16:06:56 +01:00

objectstorage-controller

refactor(build): mode=max registry cache with a main-only warmer (#2938)

2026-06-18 10:40:05 +05:00

openbao

feat(openbao): add system chart with vendored upstream

2026-02-17 20:03:01 +03:00

openbao-rd

chore(apps): regenerate schemas and ApplicationDefinitions with x-cozystack-options

2026-06-02 16:42:58 +03:00

opencost

Fix pre-commit check

2026-01-20 03:24:32 +01:00

opensearch-operator

fix(opensearch-operator): use values.yaml override instead of patch

2026-05-20 15:45:08 +05:00

opensearch-rd

chore(apps): regenerate schemas and ApplicationDefinitions with x-cozystack-options

2026-06-02 16:42:58 +03:00

ouroboros

fix(networking): point host ouroboros proxy at the root-tenant ingress (#2800)

2026-06-08 16:41:15 +03:00

piraeus-operator

[piraeus-operator] Split LINSTOR controller availability and metrics alerts

2026-03-25 16:11:14 +03:00

piraeus-operator-crds

Move CRDs installation logic to piraeus-operator-crds chart

2026-02-11 22:54:56 +01:00

postgres-operator

docs(postgres-operator): fix backoffLimit/activeDeadlineSeconds comment math

2026-04-24 13:33:07 +03:00

postgres-rd

chore(apps): regenerate schemas and ApplicationDefinitions with x-cozystack-options

2026-06-02 16:42:58 +03:00

prometheus-operator-crds

fix(prometheus-operator-crds): clean chart dir before helm pull

2026-06-16 14:19:47 +05:00

qdrant

[qdrant] Add Qdrant vector database application

2026-02-06 13:30:58 +03:00

qdrant-rd

chore(apps): regenerate schemas and ApplicationDefinitions with x-cozystack-options

2026-06-02 16:42:58 +03:00

rabbitmq-operator

refactor: move scripts to hack directory

2026-01-15 16:06:56 +01:00

rabbitmq-rd

chore(apps): regenerate schemas and ApplicationDefinitions with x-cozystack-options

2026-06-02 16:42:58 +03:00

redis-operator

refactor(build): mode=max registry cache with a main-only warmer (#2938)

2026-06-18 10:40:05 +05:00

redis-rd

chore(apps): regenerate schemas and ApplicationDefinitions with x-cozystack-options

2026-06-02 16:42:58 +03:00

reloader

refactor: move scripts to hack directory

2026-01-15 16:06:56 +01:00

seaweedfs

fix(seaweedfs): vendor -lock/-readonly BucketClass + s3 service name as patches

2026-06-19 21:30:38 +02:00

seaweedfs-db

test: cover flux v2.8 chart fixes and wire missing test targets

2026-05-31 15:02:33 +05:00

seaweedfs-rd

feat(apps): instance-type resourcesPreset across apps and extras

2026-05-11 21:08:41 +03:00

securitygroup-controller

feat(platform): deploy the securitygroup-controller

2026-06-25 17:50:33 +03:00

snapshot-controller

refactor: move scripts to hack directory

2026-01-15 16:06:56 +01:00

tcp-balancer-rd

feat(apps): instance-type resourcesPreset across apps and extras

2026-05-11 21:08:41 +03:00

telepresence

refactor: move scripts to hack directory

2026-01-15 16:06:56 +01:00

tenant-rd

fix(tenant): bump parent HR timeout to 15m to cover seaweedfs split

2026-05-28 12:46:57 +05:00

velero

feat(platform): add default backupclass

2026-05-28 13:49:59 +04:00

vertical-pod-autoscaler

fix(vpa): break circular wait between parent install and nested vpa-for-vpa HR

2026-05-28 12:43:50 +05:00

vertical-pod-autoscaler-crds

refactor: move scripts to hack directory

2026-01-15 16:06:56 +01:00

victoria-metrics-operator

feat(monitoring): upgrade victoria-metrics-operator to v0.68.4

2026-04-20 15:48:53 +03:00

virtualprivatecloud-rd

[docs] Update cozyvalues-gen

2026-03-25 15:59:22 +05:00

vm-default-images

[vm-default-images] Default to replicated storageClass and document storage requirements

2026-04-14 19:59:20 +05:00

vm-disk-rd

chore(apps): regenerate schemas and ApplicationDefinitions with x-cozystack-options

2026-06-02 16:42:58 +03:00

vm-instance-rd

chore(apps): regenerate schemas and ApplicationDefinitions with x-cozystack-options

2026-06-02 16:42:58 +03:00

vpn-rd

feat(apps): instance-type resourcesPreset across apps and extras

2026-05-11 21:08:41 +03:00

vsnap-crd

refactor: move scripts to hack directory

2026-01-15 16:06:56 +01:00

Makefile

refactor: move scripts to hack directory

2026-01-15 16:06:56 +01:00