Aleksei Sviridkin
a9c8f206e8
Upgrade vendored MetalLB chart from 0.15.2 to 0.16.1 and rebuild the cozystack-built controller / speaker images at the new version (pinned to linux/amd64 in the Makefile to match the prior baseline and the e2e Talos sandbox arch — without the pin, a contributor building on an arm64 host like Apple Silicon ships single-arch arm64 images that crashloop on amd64 nodes with "exec format error"). Adopt the upstream-default BGP backend: FRR-K8s replaces the deprecated FRR mode. Rotate the cilium-networkpolicy clusterwide host-network port denylist to match the new metallb endpoints. The Makefile now vendors the frr-k8s subchart instead of dropping it, and pins the chart version so future make update invocations are deterministic. Upstream highlights between 0.15.2 and 0.16.1: - 0.16.0: FRR-K8s is the new default BGP backend; legacy FRR is deprecated. - 0.16.0: new probe contract — metallb controller and speaker serve /healthz and /readyz on a dedicated host-local health port 17472 (distinct from the metrics port). The frr-k8s controller uses its own host-local probe port 7572. The cozystack-built image must move in lockstep with the chart so probes resolve against the new endpoints. - 0.16.0: kube-rbac-proxy is replaced by native TLS; metrics endpoints are HTTPS-only, served on the formerly-rbac-proxy port 9120. Default TLS minimum is now 1.3 (was 1.2); operators with TLS 1.2 scrapers override via metallb.tls.minVersion: VersionTLS12. - 0.16.0: new tls.* and networkpolicies.* value blocks (opt-in defaults). - 0.16.1: chart-only patch on top of 0.16.0 — the liveness/readiness probe port is now a configurable value (default unchanged at 17472) and the controller probes drop the hardcoded host: 127.0.0.1; pods, ServiceMonitor and PodMonitor gain prometheus.io/scheme: https for the HTTPS metrics endpoint; the frr-k8s subchart gains an opt-in ServiceMonitor toggle (default off); one CRD numeric field widens from int32 to int64. - 0.15.3: ConfigurationState CRD exposes reconcile errors per component; Helm chart gained NetworkPolicy support and tightened pod SecurityContext. Adaptations: - packages/system/metallb/Makefile: pin helm pull --version 0.16.1; remove the rm -rf charts/metallb/charts/frr-k8s line so the new default BGP backend ships with the chart; add a test: target running helm unittest; hardcode --platform=linux/amd64 on the buildx invocations so the image arch does not depend on the contributor's host. - packages/system/metallb/charts/metallb/: regenerated via make update. - packages/system/metallb/values.yaml: cozystack-built controller and speaker image tags moved to v0.16.1 with fresh linux/amd64 digests pushed to ghcr.io/cozystack/cozystack. The chart's new probe contract requires the v0.16.x binary; leaving the digests on v0.15.2 would CrashLoopBackOff every pod on main between merge and the next release-prep commit. A header comment documents the backend default switch, the metrics-port move (7472 HTTP → 9120 HTTPS), the new TLS 1.3 default, the new host-network ports (9140, 9141, 19443), and the partial nature of the FRR-mode escape hatch — flipping metallb.frrk8s.enabled=false plus metallb.speaker.frr.enabled=true switches the speaker but does not suppress the idle frr-k8s subchart, because Helm evaluates a dep's `condition:` against the declaring chart's own values context and a grandparent override from the umbrella cannot reach that resolution. - packages/system/metallb/tests/metallb_test.yaml: new helm-unittest suite pinning post-bump invariants — speaker is the single-container daemonset, BGP_TYPE is frr-k8s, frr-k8s daemonset and CRDs are installed, NetworkPolicies stay off by default, controller/speaker image tags exactly match the chart appVersion (the test that would have caught the chart / binary skew up-front), and the documented FRR-mode escape hatch is pinned in both halves (speaker switches to four-container FRR layout, frr-k8s subchart still renders idle — the latter test is the contract that a future cleanup must update together with the values.yaml note). - packages/system/cilium-networkpolicy/templates/networkpolicy.yaml: drop the stale FRR-mode metrics port 7473; add every metallb v0.16 host-network listener that this policy file is responsible for — 7946 (speaker memberlist gossip, TCP/UDP; cluster peers still reach it via the same policy's ingress fromEntities[cluster,host] clause), 9120 (speaker metrics), 9121 (legacy FRR metrics, kept defensively so the documented escape hatch stays safe), 9140 (frr-k8s controller metrics), 9141 (frr-k8s FRR metrics), 19443 (frr-k8s statuscleaner webhook). Port 9443 stays in the deny list with a tightened comment: the host-network bind belongs to the etcd kube-rbac-proxy DaemonSet in cozy-monitoring; the metallb controller webhook collides on the same port number but on pod-IP, out of scope for a world-deny. - packages/system/cilium-networkpolicy/tests/networkpolicy_test.yaml: new helm-unittest suite that enumerates every metallb v0.16 host-network port in the deny list (including 7946 memberlist and the escape-hatch 9121), pins port 9443 to its etcd kube-rbac-proxy owner with the pod-IP collision note, and asserts the legacy 7473 entry is gone. Assisted-By: Claude <noreply@anthropic.com> Signed-off-by: Aleksei Sviridkin <f@lex.la>
Cozystack
Cozystack is a free platform and framework for building clouds.
Cozystack is a CNCF Sandbox Level Project that was originally built and sponsored by Ænix.
With Cozystack, you can transform a bunch of servers into an intelligent system with a simple REST API for spawning Kubernetes clusters, Database-as-a-Service, virtual machines, load balancers, HTTP caching services, and other services with ease.
Use Cozystack to build your own cloud or provide a cost-effective development environment.
Use-Cases
-
Using Cozystack to build a public cloud
You can use Cozystack as a backend for a public cloud -
Using Cozystack to build a private cloud
You can use Cozystack as a platform to build a private cloud powered by Infrastructure-as-Code approach -
Using Cozystack as a Kubernetes distribution
You can use Cozystack as a Kubernetes distribution for Bare Metal
Documentation
The documentation is located on the cozystack.io website.
Read the Getting Started section for a quick start.
If you encounter any difficulties, start with the troubleshooting guide and work your way through the process that we've outlined.
Versioning
Versioning adheres to the Semantic Versioning principles.
A full list of the available releases is available in the GitHub repository's Release section.
Contributions
Contributions are highly appreciated and very welcomed!
In case of bugs, please check if the issue has already been opened by checking the GitHub Issues section. If it isn't, you can open a new one. A detailed report will help us replicate it, assess it, and work on a fix.
You can express your intention to on the fix on your own. Commits are used to generate the changelog, and their author will be referenced in it.
If you have Feature Requests please use the Discussion's Feature Request section.
Community
You are welcome to join our Telegram group and come to our weekly community meetings. Add them to your Google Calendar or iCal for convenience.
License
Cozystack is licensed under Apache 2.0.
The code is provided as-is with no warranties.
Commercial Support
A list of companies providing commercial support for this project can be found on official site.