From a628adeb35826ff292ecd0eeefbf8f0c0b16e493 Mon Sep 17 00:00:00 2001
From: Andrei Kvapil <kvapss@gmail.com>
Date: Thu, 12 Feb 2026 17:18:14 +0100
Subject: [PATCH] [platform] Switch cozystack-api from DaemonSet to Deployment
 with PreferClose

Replace DaemonSet with direct host API access in favor of a regular
Deployment using Service trafficDistribution: PreferClose. This provides
prefer-local routing to the nearest cozystack-api pod with fallback
to remote pods when local one is unavailable.

- Replace DaemonSet/Deployment toggle with always-Deployment
- Replace internalTrafficPolicy: Local with trafficDistribution: PreferClose
- Remove KUBERNETES_SERVICE_HOST/PORT override (use default kubernetes service)
- Replace hard nodeSelector with soft nodeAffinity for control-plane nodes
- Simplify migration hook to always clean up DaemonSet if present

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
---
 .../cozystack-api/templates/deployment.yaml   | 30 +++++--------------
 .../system/cozystack-api/templates/hook.yaml  | 17 ++---------
 .../cozystack-api/templates/service.yaml      |  4 +--
 packages/system/cozystack-api/values.yaml     |  7 -----
 4 files changed, 12 insertions(+), 46 deletions(-)

diff --git a/packages/system/cozystack-api/templates/deployment.yaml b/packages/system/cozystack-api/templates/deployment.yaml
index aa877266..9febfe1e 100644
--- a/packages/system/cozystack-api/templates/deployment.yaml
+++ b/packages/system/cozystack-api/templates/deployment.yaml
@@ -1,18 +1,12 @@
 apiVersion: apps/v1
-{{- if .Values.cozystackAPI.localK8sAPIEndpoint.enabled }}
-kind: DaemonSet
-{{- else }}
 kind: Deployment
-{{- end }}
 metadata:
   name: cozystack-api
   namespace: cozy-system
   labels:
     app: cozystack-api
 spec:
-  {{- if not .Values.cozystackAPI.localK8sAPIEndpoint.enabled }}
   replicas: {{ .Values.cozystackAPI.replicas }}
-  {{- end }}
   selector:
     matchLabels:
       app: cozystack-api
@@ -24,27 +18,19 @@ spec:
       tolerations:
       - operator: Exists
       serviceAccountName: cozystack-api
-      {{- if .Values.cozystackAPI.localK8sAPIEndpoint.enabled }}
-      {{- with .Values.cozystackAPI.nodeSelector }}
-      nodeSelector:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- end }}
+      affinity:
+        nodeAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+          - weight: 100
+            preference:
+              matchExpressions:
+              - key: node-role.kubernetes.io/control-plane
+                operator: Exists
       containers:
       - name: cozystack-api
         args:
         - --tls-cert-file=/tmp/cozystack-api-certs/tls.crt
         - --tls-private-key-file=/tmp/cozystack-api-certs/tls.key
-        {{- if .Values.cozystackAPI.localK8sAPIEndpoint.enabled }}
-        env:
-        - name: KUBERNETES_SERVICE_HOST
-          valueFrom:
-            fieldRef:
-              apiVersion: v1
-              fieldPath: status.hostIP
-        - name: KUBERNETES_SERVICE_PORT
-          value: "6443"
-        {{- end }}
         image: "{{ .Values.cozystackAPI.image }}"
         ports:
         - containerPort: 443
diff --git a/packages/system/cozystack-api/templates/hook.yaml b/packages/system/cozystack-api/templates/hook.yaml
index 3c6b3080..852b2db0 100644
--- a/packages/system/cozystack-api/templates/hook.yaml
+++ b/packages/system/cozystack-api/templates/hook.yaml
@@ -1,16 +1,5 @@
-{{- $shouldRunUpdateHook := false }}
-{{- $previousKind := "Deployment" }}
-{{- $previousKindPlural := "deployments" }}
-{{- if not .Values.cozystackAPI.localK8sAPIEndpoint.enabled }}
-  {{- $previousKind = "DaemonSet" }}
-  {{- $previousKindPlural = "daemonsets" }}
-{{- end }}
-{{- $previous := lookup "apps/v1" $previousKind .Release.Namespace "cozystack-api" }}
+{{- $previous := lookup "apps/v1" "DaemonSet" .Release.Namespace "cozystack-api" }}
 {{- if $previous }}
-  {{- $shouldRunUpdateHook = true }}
-{{- end }}
-
-{{- if $shouldRunUpdateHook }}
 ---
 apiVersion: batch/v1
 kind: Job
@@ -36,7 +25,7 @@ spec:
             - -exc
             - |-
               kubectl --namespace={{ .Release.Namespace }} delete --ignore-not-found \
-                {{ $previousKindPlural }}.apps cozystack-api
+                daemonsets.apps cozystack-api
       restartPolicy: Never
 ---
 apiVersion: rbac.authorization.k8s.io/v1
@@ -51,7 +40,7 @@ rules:
 - apiGroups:
   - "apps"
   resources:
-  - "{{ $previousKindPlural }}"
+  - "daemonsets"
   verbs:
   - get
   - delete
diff --git a/packages/system/cozystack-api/templates/service.yaml b/packages/system/cozystack-api/templates/service.yaml
index abe67abc..64ba149d 100644
--- a/packages/system/cozystack-api/templates/service.yaml
+++ b/packages/system/cozystack-api/templates/service.yaml
@@ -4,9 +4,7 @@ metadata:
   name: cozystack-api
   namespace: cozy-system
 spec:
-  {{- if .Values.cozystackAPI.localK8sAPIEndpoint.enabled }}
-  internalTrafficPolicy: Local
-  {{- end }}
+  trafficDistribution: PreferClose
   ports:
   - port: 443
     protocol: TCP
diff --git a/packages/system/cozystack-api/values.yaml b/packages/system/cozystack-api/values.yaml
index d9631b94..769cd4b6 100644
--- a/packages/system/cozystack-api/values.yaml
+++ b/packages/system/cozystack-api/values.yaml
@@ -1,10 +1,3 @@
 cozystackAPI:
   image: ghcr.io/cozystack/cozystack/cozystack-api:v1.0.0-beta.3@sha256:a263702859c36f85d097c300c1be462aaa45a3955d69e9ae72a37cabf6dadaa9
-  localK8sAPIEndpoint:
-    enabled: true
   replicas: 2
-  # nodeSelector for DaemonSet mode (localK8sAPIEndpoint.enabled: true)
-  # Talos uses empty value: "node-role.kubernetes.io/control-plane": ""
-  # Generic k8s (k3s, kubeadm) uses: "node-role.kubernetes.io/control-plane": "true"
-  nodeSelector:
-    node-role.kubernetes.io/control-plane: ""