mirror of
https://github.com/cozystack/cozystack.git
synced 2026-11-09 05:25:14 +09:00
Myasnikov Daniil
9aa8710ef2
Bump flux-operator and flux-instance vendored charts from v0.33.0 to v0.48.0, moving the Flux distribution from 2.7.x to 2.8.x. This brings helm-controller v1.5.x, which exposes spec.install.healthCheckExprs on HelmRelease — a prerequisite for adding real readiness gating to dependency-target packages (postgres, mongodb, kafka, etc.). The new flux-operator chart defaults web.enabled=true; override it to false in packages/system/fluxcd-operator/values.yaml so the Flux Status Web UI stays opt-in. Operators wanting it can set web.enabled=true and configure web.config / web.configSecretName / web.ingress per the upstream chart values. Patches reapplied: - kubernetesEnvs.diff: matched cleanly (offset shift only) - networkPolicy.diff: extended to also restrict port 9080 (web UI port); hunk count updated 20 -> 22 Pre-flight: no references to the v0.39-removed --disable-wait-interruption flag anywhere in packages/ or internal/. Verified locally: - helm template renders both packages without errors - web.enabled=false (default): no web Deployment/Service/NetworkPolicy - web.enabled=true: renders web NetworkPolicy on port 9080 - CiliumClusterwideNetworkPolicy lists 8080/8081/9080 - FluxInstance distribution.version: "2.8.x", all 7 components present - Cozystack kustomize patches (concurrent, requeue, storage-adv-addr, events-addr) intact Notable upstream changes between v0.33 and v0.48: - Flux 2.8.x with HelmRelease inventory format change (auto-migrated) - Reliability fixes for stuck FluxInstance/ResourceSet on health-check cancellation (v0.39, v0.46) - New CLI: flux-operator migrate, diff, patch instance, distro mirror - ResourceSetInputProvider: GitLab Environments, GitHub App, Gitea/Forgejo - CVE-2026-23990 (Web UI OIDC impersonation bypass) — N/A while web is off Assisted-By: Claude <noreply@anthropic.com> Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>