[platform] Migrate from HelmRelease bundles to Package-based deployment (#1816)

Replace HelmRelease-based bundle system with Package resources managed
by cozystack-operator. Restructure values.yaml with full configuration
support.

## What this PR does

- Restructure values.yaml with full configuration (networking,
publishing, authentication, scheduling, branding, resources)
- Add values-isp-full.yaml and values-isp-hosted.yaml for bundle
variants
- Create templates/packages/isp-full.yaml with Package resources
- Move PackageSources from sources/ to templates/sources/
- Remove old bundle files and HelmRelease templates
- Add hack/migrate-to-version-1.0.sh migration script for converting
ConfigMaps to Package resource

### Release note

```release-note
[platform] Migrate from HelmRelease bundles to Package-based deployment
```

Makefile

@@ -1,4 +1,4 @@
-.PHONY: manifests repos assets unit-tests helm-unit-tests
+.PHONY: manifests assets unit-tests helm-unit-tests
 
 build-deps:
 	@command -V find docker skopeo jq gh helm > /dev/null
@@ -16,6 +16,7 @@ build: build-deps
 	make -C packages/system/cozystack-api image
 	make -C packages/system/cozystack-controller image
 	make -C packages/system/backup-controller image
+	make -C packages/system/backupstrategy-controller image
 	make -C packages/system/lineage-controller-webhook image
 	make -C packages/system/cilium image
 	make -C packages/system/linstor image
@@ -26,21 +27,15 @@ build: build-deps
 	make -C packages/system/kamaji image
 	make -C packages/system/bucket image
 	make -C packages/system/objectstorage-controller image
+	make -C packages/system/grafana-operator image
 	make -C packages/core/testing image
 	make -C packages/core/talos image
-	make -C packages/core/platform image
 	make -C packages/core/installer image
 	make manifests
 
-repos:
-	rm -rf _out
-	make -C packages/system repo
-	make -C packages/apps repo
-	make -C packages/extra repo
-
 manifests:
 	mkdir -p _out/assets
-	(cd packages/core/installer/; helm template -n cozy-installer installer .) > _out/assets/cozystack-installer.yaml
+	(cd packages/core/installer/; helm template --namespace cozy-installer installer .) > _out/assets/cozystack-installer.yaml
 
 assets:
 	make -C packages/core/talos assets

api/v1alpha1/cozystackresourcedefinitions_types.go

@@ -17,6 +17,7 @@ limitations under the License.
 package v1alpha1
 
 import (
+	helmv2 "github.com/fluxcd/helm-controller/api/v2"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 )
 
@@ -61,24 +62,6 @@ type CozystackResourceDefinitionSpec struct {
 	Dashboard *CozystackResourceDefinitionDashboard `json:"dashboard,omitempty"`
 }
 
-type CozystackResourceDefinitionChart struct {
-	// Name of the Helm chart
-	Name string `json:"name"`
-	// Source reference for the Helm chart
-	SourceRef SourceRef `json:"sourceRef"`
-}
-
-type SourceRef struct {
-	// Kind of the source reference
-	// +kubebuilder:default:="HelmRepository"
-	Kind string `json:"kind"`
-	// Name of the source reference
-	Name string `json:"name"`
-	// Namespace of the source reference
-	// +kubebuilder:default:="cozy-public"
-	Namespace string `json:"namespace"`
-}
-
 type CozystackResourceDefinitionApplication struct {
 	// Kind of the application, used for UI and API
 	Kind string `json:"kind"`
@@ -91,9 +74,8 @@ type CozystackResourceDefinitionApplication struct {
 }
 
 type CozystackResourceDefinitionRelease struct {
-	// Helm chart configuration
-	// +optional
-	Chart CozystackResourceDefinitionChart `json:"chart,omitempty"`
+	// Reference to the chart source
+	ChartRef *helmv2.CrossNamespaceSourceReference `json:"chartRef"`
 	// Labels for the release
 	Labels map[string]string `json:"labels,omitempty"`
 	// Prefix for the release name

api/v1alpha1/zz_generated.deepcopy.go

@@ -21,6 +21,7 @@ limitations under the License.
 package v1alpha1
 
 import (
+	"github.com/fluxcd/helm-controller/api/v2"
 	"k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
 	"k8s.io/apimachinery/pkg/api/resource"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -118,22 +119,6 @@ func (in *CozystackResourceDefinitionApplication) DeepCopy() *CozystackResourceD
 	return out
 }
 
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *CozystackResourceDefinitionChart) DeepCopyInto(out *CozystackResourceDefinitionChart) {
-	*out = *in
-	out.SourceRef = in.SourceRef
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CozystackResourceDefinitionChart.
-func (in *CozystackResourceDefinitionChart) DeepCopy() *CozystackResourceDefinitionChart {
-	if in == nil {
-		return nil
-	}
-	out := new(CozystackResourceDefinitionChart)
-	in.DeepCopyInto(out)
-	return out
-}
-
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *CozystackResourceDefinitionDashboard) DeepCopyInto(out *CozystackResourceDefinitionDashboard) {
 	*out = *in
@@ -205,7 +190,11 @@ func (in *CozystackResourceDefinitionList) DeepCopyObject() runtime.Object {
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *CozystackResourceDefinitionRelease) DeepCopyInto(out *CozystackResourceDefinitionRelease) {
 	*out = *in
-	out.Chart = in.Chart
+	if in.ChartRef != nil {
+		in, out := &in.ChartRef, &out.ChartRef
+		*out = new(v2.CrossNamespaceSourceReference)
+		**out = **in
+	}
 	if in.Labels != nil {
 		in, out := &in.Labels, &out.Labels
 		*out = make(map[string]string, len(*in))
@@ -622,21 +611,6 @@ func (in Selector) DeepCopy() Selector {
 	return *out
 }
 
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *SourceRef) DeepCopyInto(out *SourceRef) {
-	*out = *in
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SourceRef.
-func (in *SourceRef) DeepCopy() *SourceRef {
-	if in == nil {
-		return nil
-	}
-	out := new(SourceRef)
-	in.DeepCopyInto(out)
-	return out
-}
-
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *Variant) DeepCopyInto(out *Variant) {
 	*out = *in

cmd/cozystack-assets-server/main.go

@@ -1,29 +0,0 @@
-package main
-
-import (
-	"flag"
-	"log"
-	"net/http"
-	"path/filepath"
-)
-
-func main() {
-	addr := flag.String("address", ":8123", "Address to listen on")
-	dir := flag.String("dir", "/cozystack/assets", "Directory to serve files from")
-	flag.Parse()
-
-	absDir, err := filepath.Abs(*dir)
-	if err != nil {
-		log.Fatalf("Error getting absolute path for %s: %v", *dir, err)
-	}
-
-	fs := http.FileServer(http.Dir(absDir))
-	http.Handle("/", fs)
-
-	log.Printf("Server starting on %s, serving directory %s", *addr, absDir)
-
-	err = http.ListenAndServe(*addr, nil)
-	if err != nil {
-		log.Fatalf("Server failed to start: %v", err)
-	}
-}

hack/cozyreport.sh

@@ -56,6 +56,26 @@ kubectl get hr -A --no-headers | awk '$4 != "True"' | \
     kubectl describe hr -n $NAMESPACE $NAME > $DIR/describe.txt 2>&1
   done
 
+echo "Collecting packages..."
+kubectl get packages -A > $REPORT_DIR/kubernetes/packages.txt 2>&1
+kubectl get packages -A --no-headers | awk '$4 != "True"' | \
+  while read NAMESPACE NAME _; do
+    DIR=$REPORT_DIR/kubernetes/packages/$NAMESPACE/$NAME
+    mkdir -p $DIR
+    kubectl get package -n $NAMESPACE $NAME -o yaml > $DIR/package.yaml 2>&1
+    kubectl describe package -n $NAMESPACE $NAME > $DIR/describe.txt 2>&1
+  done
+
+echo "Collecting packagesources..."
+kubectl get packagesources -A > $REPORT_DIR/kubernetes/packagesources.txt 2>&1
+kubectl get packagesources -A --no-headers | awk '$4 != "True"' | \
+  while read NAMESPACE NAME _; do
+    DIR=$REPORT_DIR/kubernetes/packagesources/$NAMESPACE/$NAME
+    mkdir -p $DIR
+    kubectl get packagesource -n $NAMESPACE $NAME -o yaml > $DIR/packagesource.yaml 2>&1
+    kubectl describe packagesource -n $NAMESPACE $NAME > $DIR/describe.txt 2>&1
+  done
+
 echo "Collecting pods..."
 kubectl get pod -A -o wide > $REPORT_DIR/kubernetes/pods.txt 2>&1
 kubectl get pod -A --no-headers | awk '$4 !~ /Running|Succeeded|Completed/' |

hack/e2e-install-cozystack.bats

@@ -8,28 +8,40 @@
 }
 
 @test "Install Cozystack" {
-  # Create namespace & configmap required by installer
+  # Create namespace
   kubectl create namespace cozy-system --dry-run=client -o yaml | kubectl apply -f -
-  kubectl create configmap cozystack -n cozy-system \
-          --from-literal=bundle-name=paas-full \
-          --from-literal=ipv4-pod-cidr=10.244.0.0/16 \
-          --from-literal=ipv4-pod-gateway=10.244.0.1 \
-          --from-literal=ipv4-svc-cidr=10.96.0.0/16 \
-          --from-literal=ipv4-join-cidr=100.64.0.0/16 \
-          --from-literal=root-host=example.org \
-          --from-literal=api-server-endpoint=https://192.168.123.10:6443 \
-          --dry-run=client -o yaml | kubectl apply -f -
 
-  # Apply installer manifests from file
+  # Apply installer manifests (CRDs + operator)
   kubectl apply -f _out/assets/cozystack-installer.yaml
 
-  # Wait for the installer deployment to become available
-  kubectl wait deployment/cozystack -n cozy-system --timeout=1m --for=condition=Available
+  # Wait for the operator deployment to become available
+  kubectl wait deployment/cozystack-operator -n cozy-system --timeout=1m --for=condition=Available
+
+  # Create platform Package with isp-full variant
+  kubectl apply -f - <<EOF
+apiVersion: cozystack.io/v1alpha1
+kind: Package
+metadata:
+  name: cozystack.cozystack-platform
+spec:
+  variant: isp-full
+  components:
+    platform:
+      values:
+        networking:
+          podCIDR: "10.244.0.0/16"
+          podGateway: "10.244.0.1"
+          serviceCIDR: "10.96.0.0/16"
+          joinCIDR: "100.64.0.0/16"
+        publishing:
+          host: "example.org"
+          apiServerEndpoint: "https://192.168.123.10:6443"
+EOF
 
   # Wait until HelmReleases appear & reconcile them
-  timeout 60 sh -ec 'until kubectl get hr -A -l cozystack.io/system-app=true | grep -q cozys; do sleep 1; done'
+  timeout 180 sh -ec 'until [ $(kubectl get hr -A --no-headers 2>/dev/null | wc -l) -gt 10 ]; do sleep 1; done'
   sleep 5
-  kubectl get hr -A -l cozystack.io/system-app=true | awk 'NR>1 {print "kubectl wait --timeout=15m --for=condition=ready -n "$1" hr/"$2" &"} END {print "wait"}' | sh -ex
+  kubectl get hr -A | awk 'NR>1 {print "kubectl wait --timeout=15m --for=condition=ready -n "$1" hr/"$2" &"} END {print "wait"}' | sh -ex
 
   # Fail the test if any HelmRelease is not Ready
   if kubectl get hr -A | grep -v " True " | grep -v NAME; then
@@ -142,7 +154,7 @@ EOF
 
 
   # Expose Cozystack services through ingress
-  kubectl patch configmap/cozystack -n cozy-system --type merge -p '{"data":{"expose-services":"api,dashboard,cdi-uploadproxy,vm-exportproxy,keycloak"}}'
+  kubectl patch package cozystack.cozystack-platform --type merge -p '{"spec":{"components":{"platform":{"values":{"publishing":{"exposedServices":["api","dashboard","cdi-uploadproxy","vm-exportproxy","keycloak"]}}}}}}'
 
   # NGINX ingress controller
   timeout 60 sh -ec 'until kubectl get deploy root-ingress-controller -n tenant-root >/dev/null 2>&1; do sleep 1; done'
@@ -169,7 +181,7 @@ EOF
 }
 
 @test "Keycloak OIDC stack is healthy" {
-  kubectl patch configmap/cozystack -n cozy-system --type merge -p '{"data":{"oidc-enabled":"true"}}'
+  kubectl patch package cozystack.cozystack-platform --type merge -p '{"spec":{"components":{"platform":{"values":{"authentication":{"oidc":{"enabled":true}}}}}}}'
 
   timeout 120 sh -ec 'until kubectl get hr -n cozy-keycloak keycloak keycloak-configure keycloak-operator >/dev/null 2>&1; do sleep 1; done'
   kubectl wait hr/keycloak hr/keycloak-configure hr/keycloak-operator -n cozy-keycloak --timeout=10m --for=condition=ready

hack/migrate-to-version-1.0.sh

@@ -0,0 +1,152 @@
+#!/bin/bash
+# Migration script from Cozystack ConfigMaps to Package-based configuration
+# This script converts cozystack, cozystack-branding, and cozystack-scheduling
+# ConfigMaps into a Package resource with the new values structure.
+
+set -e
+
+NAMESPACE="cozy-system"
+
+echo "Cozystack Migration to v1.0"
+echo "==========================="
+echo ""
+echo "This script will convert existing ConfigMaps to a Package resource."
+echo ""
+
+# Check if kubectl is available
+if ! command -v kubectl &> /dev/null; then
+    echo "Error: kubectl is not installed or not in PATH"
+    exit 1
+fi
+
+# Check if we can access the cluster
+if ! kubectl get namespace "$NAMESPACE" &> /dev/null; then
+    echo "Error: Cannot access namespace $NAMESPACE"
+    exit 1
+fi
+
+# Read ConfigMap cozystack
+echo "Reading ConfigMap cozystack..."
+COZYSTACK_CM=$(kubectl get configmap -n "$NAMESPACE" cozystack -o json 2>/dev/null || echo "{}")
+
+# Read ConfigMap cozystack-branding
+echo "Reading ConfigMap cozystack-branding..."
+BRANDING_CM=$(kubectl get configmap -n "$NAMESPACE" cozystack-branding -o json 2>/dev/null || echo "{}")
+
+# Read ConfigMap cozystack-scheduling
+echo "Reading ConfigMap cozystack-scheduling..."
+SCHEDULING_CM=$(kubectl get configmap -n "$NAMESPACE" cozystack-scheduling -o json 2>/dev/null || echo "{}")
+
+# Extract values from cozystack ConfigMap
+CLUSTER_DOMAIN=$(echo "$COZYSTACK_CM" | jq -r '.data["cluster-domain"] // "cozy.local"')
+ROOT_HOST=$(echo "$COZYSTACK_CM" | jq -r '.data["root-host"] // "example.org"')
+API_SERVER_ENDPOINT=$(echo "$COZYSTACK_CM" | jq -r '.data["api-server-endpoint"] // ""')
+OIDC_ENABLED=$(echo "$COZYSTACK_CM" | jq -r '.data["oidc-enabled"] // "false"')
+TELEMETRY_ENABLED=$(echo "$COZYSTACK_CM" | jq -r '.data["telemetry-enabled"] // "true"')
+BUNDLE_NAME=$(echo "$COZYSTACK_CM" | jq -r '.data["bundle-name"] // "paas-full"')
+
+# Network configuration
+POD_CIDR=$(echo "$COZYSTACK_CM" | jq -r '.data["ipv4-pod-cidr"] // "10.244.0.0/16"')
+POD_GATEWAY=$(echo "$COZYSTACK_CM" | jq -r '.data["ipv4-pod-gateway"] // "10.244.0.1"')
+SVC_CIDR=$(echo "$COZYSTACK_CM" | jq -r '.data["ipv4-svc-cidr"] // "10.96.0.0/16"')
+JOIN_CIDR=$(echo "$COZYSTACK_CM" | jq -r '.data["ipv4-join-cidr"] // "100.64.0.0/16"')
+
+# Determine bundle type
+case "$BUNDLE_NAME" in
+    paas-full|distro-full)
+        SYSTEM_ENABLED="true"
+        SYSTEM_TYPE="full"
+        ;;
+    paas-hosted|distro-hosted)
+        SYSTEM_ENABLED="false"
+        SYSTEM_TYPE="hosted"
+        ;;
+    *)
+        SYSTEM_ENABLED="false"
+        SYSTEM_TYPE="hosted"
+        ;;
+esac
+
+# Extract branding if available
+DASHBOARD_BRANDING=$(echo "$BRANDING_CM" | jq -r '.data["dashboard"] // "{}"')
+KEYCLOAK_BRANDING=$(echo "$BRANDING_CM" | jq -r '.data["keycloak"] // "{}"')
+
+# Extract scheduling if available
+SCHEDULING_CONSTRAINTS=$(echo "$SCHEDULING_CM" | jq -r '.data["topologySpreadConstraints"] // "[]"')
+
+echo ""
+echo "Extracted configuration:"
+echo "  Cluster Domain: $CLUSTER_DOMAIN"
+echo "  Root Host: $ROOT_HOST"
+echo "  API Server Endpoint: $API_SERVER_ENDPOINT"
+echo "  OIDC Enabled: $OIDC_ENABLED"
+echo "  Bundle Name: $BUNDLE_NAME"
+echo "  System Enabled: $SYSTEM_ENABLED"
+echo "  System Type: $SYSTEM_TYPE"
+echo ""
+
+# Generate Package YAML
+PACKAGE_YAML=$(cat <<EOF
+apiVersion: cozystack.io/v1alpha1
+kind: Package
+metadata:
+  name: cozystack.cozystack-platform
+  namespace: $NAMESPACE
+spec:
+  variant: $BUNDLE_NAME
+  components:
+    platform:
+      values:
+        bundles:
+          system:
+            enabled: $SYSTEM_ENABLED
+            type: "$SYSTEM_TYPE"
+          iaas:
+            enabled: true
+          paas:
+            enabled: true
+          naas:
+            enabled: true
+        networking:
+          clusterDomain: "$CLUSTER_DOMAIN"
+          podCIDR: "$POD_CIDR"
+          podGateway: "$POD_GATEWAY"
+          serviceCIDR: "$SVC_CIDR"
+          joinCIDR: "$JOIN_CIDR"
+        publishing:
+          host: "$ROOT_HOST"
+          apiServerEndpoint: "$API_SERVER_ENDPOINT"
+        authentication:
+          oidc:
+            enabled: $OIDC_ENABLED
+        scheduling:
+          topologySpreadConstraints: $SCHEDULING_CONSTRAINTS
+        branding:
+          dashboard: $DASHBOARD_BRANDING
+          keycloak: $KEYCLOAK_BRANDING
+EOF
+)
+
+echo "Generated Package resource:"
+echo "---"
+echo "$PACKAGE_YAML"
+echo "---"
+echo ""
+
+read -p "Do you want to apply this Package? (y/N) " -n 1 -r
+echo ""
+
+if [[ $REPLY =~ ^[Yy]$ ]]; then
+    echo "Applying Package..."
+    echo "$PACKAGE_YAML" | kubectl apply -f -
+    echo ""
+    echo "Package applied successfully!"
+    echo ""
+    echo "You can now safely delete the old ConfigMaps after verifying the migration:"
+    echo "  kubectl delete configmap -n $NAMESPACE cozystack cozystack-branding cozystack-scheduling"
+else
+    echo "Package not applied. You can save the output above and apply it manually."
+fi
+
+echo ""
+echo "Migration complete!"

hack/update-crd.sh

@@ -65,6 +65,15 @@ case "$PWD" in
   *"/extra/"*) SOURCE_NAME="cozystack-extra" ;;
 esac
 
+# Determine variant from PackageSource file
+# Look for packages/core/platform/sources/${NAME}-application.yaml
+PACKAGE_SOURCE_FILE="../../core/platform/sources/${NAME}-application.yaml"
+if [[ -f "$PACKAGE_SOURCE_FILE" ]]; then
+  VARIANT="$(yq -r '.spec.variants[0].name // "default"' "$PACKAGE_SOURCE_FILE")"
+else
+  VARIANT="default"
+fi
+
 # If file doesn't exist, create a minimal skeleton
 OUT="${OUT:-$CRD_DIR/$NAME.yaml}"
 if [[ ! -f "$OUT" ]]; then
@@ -86,6 +95,7 @@ fi
 export DESCRIPTION="$DESC"
 export ICON_B64="$ICON_B64"
 export SOURCE_NAME="$SOURCE_NAME"
+export VARIANT="$VARIANT"
 export SCHEMA_JSON_MIN="$(jq -c . "$SCHEMA_JSON")"
 
 # Generate keysOrder from values.yaml
@@ -118,8 +128,8 @@ export KEYS_ORDER="$(
 # Update only necessary fields in-place
 # - openAPISchema is loaded from file as a multi-line string (block scalar)
 # - labels ensure cozystack.io/ui: "true"
-# - prefix = "<name>-"
-# - sourceRef derived from directory (apps|extra)
+# - prefix = "<name>-" or "" for extra
+# - chartRef points to ExternalArtifact created by Package controller
 yq -i '
   .apiVersion = (.apiVersion // "cozystack.io/v1alpha1") |
   .kind       = (.kind       // "CozystackResourceDefinition") |
@@ -128,10 +138,9 @@ yq -i '
   (.spec.application.openAPISchema style="literal") |
   .spec.release.prefix = (strenv(PREFIX)) |
   .spec.release.labels."cozystack.io/ui" = "true" |
-  .spec.release.chart.name = strenv(RES_NAME) |
-  .spec.release.chart.sourceRef.kind = "HelmRepository" |
-  .spec.release.chart.sourceRef.name = strenv(SOURCE_NAME) |
-  .spec.release.chart.sourceRef.namespace = "cozy-public" |
+  .spec.release.chartRef.kind = "ExternalArtifact" |
+  .spec.release.chartRef.name = ("cozystack-" + strenv(RES_NAME) + "-application-" + strenv(VARIANT) + "-" + strenv(RES_NAME)) |
+  .spec.release.chartRef.namespace = "cozy-system" |
   .spec.dashboard.description = strenv(DESCRIPTION) |
   .spec.dashboard.icon = strenv(ICON_B64) |
   .spec.dashboard.keysOrder = env(KEYS_ORDER)

internal/controller/cozystackresourcedefinition_helmreconciler.go

@@ -73,7 +73,7 @@ func (r *CozystackResourceDefinitionHelmReconciler) updateHelmReleasesForCRD(ctx
 	labelSelector := client.MatchingLabels{
 		"apps.cozystack.io/application.kind":  applicationKind,
 		"apps.cozystack.io/application.group": applicationGroup,
-		"cozystack.io/ui":                      "true",
+		"cozystack.io/ui":                     "true",
 	}
 
 	// List all HelmReleases with matching labels
@@ -130,55 +130,30 @@ func (r *CozystackResourceDefinitionHelmReconciler) updateHelmReleaseChart(ctx c
 	hrCopy := hr.DeepCopy()
 	updated := false
 
-	// Validate Chart configuration exists
-	if crd.Spec.Release.Chart.Name == "" {
-		logger.V(4).Info("Skipping HelmRelease chart update: Chart.Name is empty", "crd", crd.Name)
+	// Validate ChartRef configuration exists
+	if crd.Spec.Release.ChartRef == nil ||
+		crd.Spec.Release.ChartRef.Kind == "" ||
+		crd.Spec.Release.ChartRef.Name == "" ||
+		crd.Spec.Release.ChartRef.Namespace == "" {
+		logger.Error(fmt.Errorf("invalid ChartRef in CRD"), "Skipping HelmRelease chartRef update: ChartRef is nil or incomplete",
+			"crd", crd.Name)
 		return nil
 	}
 
-	// Validate SourceRef fields
-	if crd.Spec.Release.Chart.SourceRef.Kind == "" ||
-		crd.Spec.Release.Chart.SourceRef.Name == "" ||
-		crd.Spec.Release.Chart.SourceRef.Namespace == "" {
-		logger.Error(fmt.Errorf("invalid SourceRef in CRD"), "Skipping HelmRelease chart update: SourceRef fields are incomplete",
-			"crd", crd.Name,
-			"kind", crd.Spec.Release.Chart.SourceRef.Kind,
-			"name", crd.Spec.Release.Chart.SourceRef.Name,
-			"namespace", crd.Spec.Release.Chart.SourceRef.Namespace)
-		return nil
-	}
+	// Use ChartRef directly from CRD
+	expectedChartRef := crd.Spec.Release.ChartRef
 
-	// Get version and reconcileStrategy from CRD or use defaults
-	version := ">= 0.0.0-0"
-	reconcileStrategy := "Revision"
-	// TODO: Add Version and ReconcileStrategy fields to CozystackResourceDefinitionChart if needed
-
-	// Build expected SourceRef
-	expectedSourceRef := helmv2.CrossNamespaceObjectReference{
-		Kind:      crd.Spec.Release.Chart.SourceRef.Kind,
-		Name:      crd.Spec.Release.Chart.SourceRef.Name,
-		Namespace: crd.Spec.Release.Chart.SourceRef.Namespace,
-	}
-
-	if hrCopy.Spec.Chart == nil {
-		// Need to create Chart spec
-		hrCopy.Spec.Chart = &helmv2.HelmChartTemplate{
-			Spec: helmv2.HelmChartTemplateSpec{
-				Chart:             crd.Spec.Release.Chart.Name,
-				Version:           version,
-				ReconcileStrategy: reconcileStrategy,
-				SourceRef:         expectedSourceRef,
-			},
-		}
+	// Check if chartRef needs to be updated
+	if hrCopy.Spec.ChartRef == nil {
+		hrCopy.Spec.ChartRef = expectedChartRef
+		// Clear the old chart field when switching to chartRef
+		hrCopy.Spec.Chart = nil
+		updated = true
+	} else if hrCopy.Spec.ChartRef.Kind != expectedChartRef.Kind ||
+		hrCopy.Spec.ChartRef.Name != expectedChartRef.Name ||
+		hrCopy.Spec.ChartRef.Namespace != expectedChartRef.Namespace {
+		hrCopy.Spec.ChartRef = expectedChartRef
 		updated = true
-	} else {
-		// Update existing Chart spec
-		if hrCopy.Spec.Chart.Spec.Chart != crd.Spec.Release.Chart.Name ||
-			hrCopy.Spec.Chart.Spec.SourceRef != expectedSourceRef {
-			hrCopy.Spec.Chart.Spec.Chart = crd.Spec.Release.Chart.Name
-			hrCopy.Spec.Chart.Spec.SourceRef = expectedSourceRef
-			updated = true
-		}
 	}
 
 	// Check and update valuesFrom configuration
@@ -189,8 +164,22 @@ func (r *CozystackResourceDefinitionHelmReconciler) updateHelmReleaseChart(ctx c
 		updated = true
 	}
 
+	// Check and update labels from CozystackResourceDefinition
+	if len(crd.Spec.Release.Labels) > 0 {
+		if hrCopy.Labels == nil {
+			hrCopy.Labels = make(map[string]string)
+		}
+		for key, value := range crd.Spec.Release.Labels {
+			if hrCopy.Labels[key] != value {
+				logger.V(4).Info("Updating HelmRelease label", "name", hr.Name, "namespace", hr.Namespace, "label", key, "value", value)
+				hrCopy.Labels[key] = value
+				updated = true
+			}
+		}
+	}
+
 	if updated {
-		logger.V(4).Info("Updating HelmRelease chart", "name", hr.Name, "namespace", hr.Namespace)
+		logger.V(4).Info("Updating HelmRelease", "name", hr.Name, "namespace", hr.Namespace)
 		if err := r.Update(ctx, hrCopy); err != nil {
 			return fmt.Errorf("failed to update HelmRelease: %w", err)
 		}
@@ -198,4 +187,3 @@ func (r *CozystackResourceDefinitionHelmReconciler) updateHelmReleaseChart(ctx c
 
 	return nil
 }
-

internal/fluxinstall/install.go

@@ -56,26 +56,31 @@ func Install(ctx context.Context, k8sClient client.Client, writeEmbeddedManifest
 		return fmt.Errorf("failed to extract embedded manifests: %w", err)
 	}
 
-	// Find the manifest file (should be fluxcd.yaml from cozypkg)
-	manifestPath := filepath.Join(manifestsDir, "fluxcd.yaml")
-	if _, err := os.Stat(manifestPath); err != nil {
-		// Try to find any YAML file if fluxcd.yaml doesn't exist
-		entries, err := os.ReadDir(manifestsDir)
-		if err != nil {
-			return fmt.Errorf("failed to read manifests directory: %w", err)
-		}
-		for _, entry := range entries {
-			if strings.HasSuffix(entry.Name(), ".yaml") {
-				manifestPath = filepath.Join(manifestsDir, entry.Name())
-				break
-			}
+	// Find all YAML manifest files
+	entries, err := os.ReadDir(manifestsDir)
+	if err != nil {
+		return fmt.Errorf("failed to read manifests directory: %w", err)
+	}
+
+	var manifestFiles []string
+	for _, entry := range entries {
+		if strings.HasSuffix(entry.Name(), ".yaml") {
+			manifestFiles = append(manifestFiles, filepath.Join(manifestsDir, entry.Name()))
 		}
 	}
 
-	// Parse and apply manifests
-	objects, err := parseManifests(manifestPath)
-	if err != nil {
-		return fmt.Errorf("failed to parse manifests: %w", err)
+	if len(manifestFiles) == 0 {
+		return fmt.Errorf("no YAML manifest files found in directory")
+	}
+
+	// Parse all manifest files
+	var objects []*unstructured.Unstructured
+	for _, manifestPath := range manifestFiles {
+		objs, err := parseManifests(manifestPath)
+		if err != nil {
+			return fmt.Errorf("failed to parse manifests from %s: %w", manifestPath, err)
+		}
+		objects = append(objects, objs...)
 	}
 
 	if len(objects) == 0 {
@@ -96,7 +101,7 @@ func Install(ctx context.Context, k8sClient client.Client, writeEmbeddedManifest
 	logger.Info("Installing Flux components", "namespace", namespace)
 
 	// Apply manifests using server-side apply
-	logger.Info("Applying Flux manifests", "count", len(objects), "manifest", manifestPath, "namespace", namespace)
+	logger.Info("Applying Flux manifests", "count", len(objects), "files", len(manifestFiles), "namespace", namespace)
 	if err := applyManifests(ctx, k8sClient, objects); err != nil {
 		return fmt.Errorf("failed to apply manifests: %w", err)
 	}
@@ -251,11 +256,17 @@ func injectKubernetesServiceEnv(objects []*unstructured.Unstructured) error {
 			continue
 		}
 
-		// Navigate to spec.template.spec.containers
+		// Navigate to spec.template.spec
 		spec, found, err := unstructured.NestedMap(obj.Object, "spec", "template", "spec")
 		if !found {
 			continue
 		}
+
+		// Skip pods that don't use hostNetwork - they should use normal Kubernetes DNS
+		hostNetwork, _, _ := unstructured.NestedBool(spec, "hostNetwork")
+		if !hostNetwork {
+			continue
+		}
 		if err != nil {
 			if firstErr == nil {
 				firstErr = fmt.Errorf("failed to get spec for %s/%s: %w", kind, obj.GetName(), err)

internal/fluxinstall/manifests/fluxcd-service.yaml

@@ -0,0 +1,18 @@
+---
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    app.kubernetes.io/name: flux
+    app.kubernetes.io/part-of: flux
+  name: flux
+  namespace: cozy-fluxcd
+spec:
+  ports:
+    - name: http
+      port: 80
+      protocol: TCP
+      targetPort: http-sc
+  selector:
+    app.kubernetes.io/name: flux
+  type: ClusterIP

internal/fluxinstall/manifests/fluxcd-tenants.yaml

@@ -0,0 +1,102 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    app.kubernetes.io/name: flux-tenants
+    app.kubernetes.io/part-of: flux
+    app.kubernetes.io/version: v2.7.3
+    sharding.fluxcd.io/role: shard
+  name: flux-tenants
+  namespace: cozy-fluxcd
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: flux-tenants
+  strategy:
+    type: Recreate
+  template:
+    metadata:
+      annotations:
+        cluster-autoscaler.kubernetes.io/safe-to-evict: "true"
+        prometheus.io/scrape: "true"
+      labels:
+        app.kubernetes.io/name: flux-tenants
+    spec:
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+              - matchExpressions:
+                  - key: kubernetes.io/os
+                    operator: In
+                    values:
+                      - linux
+      containers:
+        - args:
+            - --watch-all-namespaces
+            - --log-level=info
+            - --log-encoding=json
+            - --enable-leader-election=false
+            - --metrics-addr=:9795
+            - --health-addr=:9796
+            - --watch-label-selector=sharding.fluxcd.io/key=tenants
+            - --concurrent=5
+            - --requeue-dependency=30s
+            - --feature-gates=ExternalArtifact=true
+          env:
+            - name: RUNTIME_NAMESPACE
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.namespace
+            - name: GOMEMLIMIT
+              valueFrom:
+                resourceFieldRef:
+                  resource: limits.memory
+            - name: TUF_ROOT
+              value: /tmp/.sigstore
+          image: "ghcr.io/fluxcd/helm-controller:v1.4.3"
+          imagePullPolicy: IfNotPresent
+          livenessProbe:
+            httpGet:
+              path: /healthz
+              port: healthz
+          name: helm-controller
+          ports:
+            - containerPort: 9795
+              name: http-prom
+              protocol: TCP
+            - containerPort: 9796
+              name: healthz
+              protocol: TCP
+          readinessProbe:
+            httpGet:
+              path: /readyz
+              port: healthz
+          resources:
+            limits:
+              memory: 1Gi
+            requests:
+              cpu: 100m
+              memory: 64Mi
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            readOnlyRootFilesystem: true
+            runAsNonRoot: true
+            seccompProfile:
+              type: RuntimeDefault
+          volumeMounts:
+            - mountPath: /tmp
+              name: tmp
+      priorityClassName: system-cluster-critical
+      securityContext:
+        fsGroup: 1337
+      serviceAccountName: flux
+      terminationGracePeriodSeconds: 60
+      volumes:
+        - emptyDir: {}
+          name: tmp

internal/fluxinstall/manifests/fluxcd.yaml

@@ -11871,7 +11871,7 @@ spec:
             - --health-addr=:9693
             - --storage-addr=:9691
             - --storage-path=/data
-            - --storage-adv-addr=source-watcher.$(RUNTIME_NAMESPACE).svc
+            - --storage-adv-addr=flux.$(RUNTIME_NAMESPACE).svc
             - --events-addr=http://localhost:9690
           env:
             - name: SOURCE_CONTROLLER_LOCALHOST

internal/operator/package_reconciler.go

@@ -211,11 +211,13 @@ func (r *PackageReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ct
 					Namespace: "cozy-system",
 				},
 				Install: &helmv2.Install{
+				Timeout: &metav1.Duration{Duration: 10 * 60 * 1000000000}, // 10m
 					Remediation: &helmv2.InstallRemediation{
 						Retries: -1,
 					},
 				},
 				Upgrade: &helmv2.Upgrade{
+				Timeout: &metav1.Duration{Duration: 10 * 60 * 1000000000}, // 10m
 					Remediation: &helmv2.UpgradeRemediation{
 						Retries: -1,
 					},

packages/apps/bucket/templates/helmrelease.yaml

@@ -2,16 +2,13 @@ apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:
   name: {{ .Release.Name }}-system
+  labels:
+    sharding.fluxcd.io/key: tenants
 spec:
-  chart:
-    spec:
-      chart: cozy-bucket
-      reconcileStrategy: Revision
-      sourceRef:
-        kind: HelmRepository
-        name: cozystack-system
-        namespace: cozy-system
-      version: '>= 0.0.0-0'
+  chartRef:
+    kind: ExternalArtifact
+    name: cozystack-bucket-application-default-bucket-system
+    namespace: cozy-system
   interval: 5m
   timeout: 10m
   install:

packages/apps/kubernetes/templates/helmreleases/cert-manager-crds.yaml

@@ -6,17 +6,13 @@ metadata:
   labels:
     cozystack.io/repository: system
     cozystack.io/target-cluster-name: {{ .Release.Name }}
+    sharding.fluxcd.io/key: tenants
 spec:
   releaseName: cert-manager-crds
-  chart:
-    spec:
-      chart: cozy-cert-manager-crds
-      reconcileStrategy: Revision
-      sourceRef:
-        kind: HelmRepository
-        name: cozystack-system
-        namespace: cozy-system
-      version: '>= 0.0.0-0'
+  chartRef:
+    kind: ExternalArtifact
+    name: cozystack-kubernetes-application-kubevirt-kubernetes-cert-manager-crds
+    namespace: cozy-system
   kubeConfig:
     secretRef:
       name: {{ .Release.Name }}-admin-kubeconfig

packages/apps/kubernetes/templates/helmreleases/cert-manager.yaml

@@ -6,17 +6,13 @@ metadata:
   labels:
     cozystack.io/repository: system
     cozystack.io/target-cluster-name: {{ .Release.Name }}
+    sharding.fluxcd.io/key: tenants
 spec:
   releaseName: cert-manager
-  chart:
-    spec:
-      chart: cozy-cert-manager
-      reconcileStrategy: Revision
-      sourceRef:
-        kind: HelmRepository
-        name: cozystack-system
-        namespace: cozy-system
-      version: '>= 0.0.0-0'
+  chartRef:
+    kind: ExternalArtifact
+    name: cozystack-kubernetes-application-kubevirt-kubernetes-cert-manager
+    namespace: cozy-system
   kubeConfig:
     secretRef:
       name: {{ .Release.Name }}-admin-kubeconfig

packages/apps/kubernetes/templates/helmreleases/cilium.yaml

@@ -20,17 +20,13 @@ metadata:
   labels:
     cozystack.io/repository: system
     cozystack.io/target-cluster-name: {{ .Release.Name }}
+    sharding.fluxcd.io/key: tenants
 spec:
   releaseName: cilium
-  chart:
-    spec:
-      chart: cozy-cilium
-      reconcileStrategy: Revision
-      sourceRef:
-        kind: HelmRepository
-        name: cozystack-system
-        namespace: cozy-system
-      version: '>= 0.0.0-0'
+  chartRef:
+    kind: ExternalArtifact
+    name: cozystack-kubernetes-application-kubevirt-kubernetes-cilium
+    namespace: cozy-system
   kubeConfig:
     secretRef:
       name: {{ .Release.Name }}-admin-kubeconfig

packages/apps/kubernetes/templates/helmreleases/coredns.yaml

@@ -11,17 +11,13 @@ metadata:
   labels:
     cozystack.io/repository: system
     cozystack.io/target-cluster-name: {{ .Release.Name }}
+    sharding.fluxcd.io/key: tenants
 spec:
   releaseName: coredns
-  chart:
-    spec:
-      chart: cozy-coredns
-      reconcileStrategy: Revision
-      sourceRef:
-        kind: HelmRepository
-        name: cozystack-system
-        namespace: cozy-system
-      version: '>= 0.0.0-0'
+  chartRef:
+    kind: ExternalArtifact
+    name: cozystack-kubernetes-application-kubevirt-kubernetes-coredns
+    namespace: cozy-system
   kubeConfig:
     secretRef:
       name: {{ .Release.Name }}-admin-kubeconfig

packages/apps/kubernetes/templates/helmreleases/csi.yaml

@@ -5,18 +5,14 @@ metadata:
   labels:
     cozystack.io/repository: system
     cozystack.io/target-cluster-name: {{ .Release.Name }}
+    sharding.fluxcd.io/key: tenants
 spec:
   interval: 5m
   releaseName: csi
-  chart:
-    spec:
-      chart: cozy-kubevirt-csi-node
-      reconcileStrategy: Revision
-      sourceRef:
-        kind: HelmRepository
-        name: cozystack-system
-        namespace: cozy-system
-      version: '>= 0.0.0-0'
+  chartRef:
+    kind: ExternalArtifact
+    name: cozystack-kubernetes-application-kubevirt-kubernetes-kubevirt-csi-node
+    namespace: cozy-system
   kubeConfig:
     secretRef:
       name: {{ .Release.Name }}-admin-kubeconfig

packages/apps/kubernetes/templates/helmreleases/fluxcd.yaml

@@ -6,17 +6,13 @@ metadata:
   labels:
     cozystack.io/repository: system
     cozystack.io/target-cluster-name: {{ .Release.Name }}
+    sharding.fluxcd.io/key: tenants
 spec:
   releaseName: fluxcd-operator
-  chart:
-    spec:
-      chart: cozy-fluxcd-operator
-      reconcileStrategy: Revision
-      sourceRef:
-        kind: HelmRepository
-        name: cozystack-system
-        namespace: cozy-system
-      version: '>= 0.0.0-0'
+  chartRef:
+    kind: ExternalArtifact
+    name: cozystack-kubernetes-application-kubevirt-kubernetes-fluxcd-operator
+    namespace: cozy-system
   kubeConfig:
     secretRef:
       name: {{ .Release.Name }}-admin-kubeconfig
@@ -53,18 +49,14 @@ metadata:
   labels:
     cozystack.io/repository: system
     cozystack.io/target-cluster-name: {{ .Release.Name }}
+    sharding.fluxcd.io/key: tenants
 spec:
   interval: 5m
   releaseName: fluxcd
-  chart:
-    spec:
-      chart: cozy-fluxcd
-      reconcileStrategy: Revision
-      sourceRef:
-        kind: HelmRepository
-        name: cozystack-system
-        namespace: cozy-system
-      version: '>= 0.0.0-0'
+  chartRef:
+    kind: ExternalArtifact
+    name: cozystack-kubernetes-application-kubevirt-kubernetes-fluxcd
+    namespace: cozy-system
   kubeConfig:
     secretRef:
       name: {{ .Release.Name }}-kubeconfig

packages/apps/kubernetes/templates/helmreleases/gateway-api-crds.yaml

@@ -6,17 +6,13 @@ metadata:
   labels:
     cozystack.io/repository: system
     cozystack.io/target-cluster-name: {{ .Release.Name }}
+    sharding.fluxcd.io/key: tenants
 spec:
   releaseName: gateway-api-crds
-  chart:
-    spec:
-      chart: cozy-gateway-api-crds
-      reconcileStrategy: Revision
-      sourceRef:
-        kind: HelmRepository
-        name: cozystack-system
-        namespace: cozy-system
-      version: '>= 0.0.0-0'
+  chartRef:
+    kind: ExternalArtifact
+    name: cozystack-kubernetes-application-kubevirt-kubernetes-gateway-api-crds
+    namespace: cozy-system
   kubeConfig:
     secretRef:
       name: {{ .Release.Name }}-admin-kubeconfig

packages/apps/kubernetes/templates/helmreleases/gpu-operator.yaml

@@ -6,17 +6,13 @@ metadata:
   labels:
     cozystack.io/repository: system
     cozystack.io/target-cluster-name: {{ .Release.Name }}
+    sharding.fluxcd.io/key: tenants
 spec:
   releaseName: gpu-operator
-  chart:
-    spec:
-      chart: cozy-gpu-operator
-      reconcileStrategy: Revision
-      sourceRef:
-        kind: HelmRepository
-        name: cozystack-system
-        namespace: cozy-system
-      version: '>= 0.0.0-0'
+  chartRef:
+    kind: ExternalArtifact
+    name: cozystack-kubernetes-application-kubevirt-kubernetes-gpu-operator
+    namespace: cozy-system
   kubeConfig:
     secretRef:
       name: {{ .Release.Name }}-admin-kubeconfig

packages/apps/kubernetes/templates/helmreleases/ingress-nginx.yaml

@@ -25,17 +25,13 @@ metadata:
   labels:
     cozystack.io/repository: system
     cozystack.io/target-cluster-name: {{ .Release.Name }}
+    sharding.fluxcd.io/key: tenants
 spec:
   releaseName: ingress-nginx
-  chart:
-    spec:
-      chart: cozy-ingress-nginx
-      reconcileStrategy: Revision
-      sourceRef:
-        kind: HelmRepository
-        name: cozystack-system
-        namespace: cozy-system
-      version: '>= 0.0.0-0'
+  chartRef:
+    kind: ExternalArtifact
+    name: cozystack-kubernetes-application-kubevirt-kubernetes-ingress-nginx
+    namespace: cozy-system
   kubeConfig:
     secretRef:
       name: {{ .Release.Name }}-admin-kubeconfig

packages/apps/kubernetes/templates/helmreleases/metrics-server.yaml

@@ -5,17 +5,13 @@ metadata:
   labels:
     cozystack.io/repository: system
     cozystack.io/target-cluster-name: {{ .Release.Name }}
+    sharding.fluxcd.io/key: tenants
 spec:
   releaseName: metrics-server
-  chart:
-    spec:
-      chart: cozy-metrics-server
-      reconcileStrategy: Revision
-      sourceRef:
-        kind: HelmRepository
-        name: cozystack-system
-        namespace: cozy-system
-      version: '>= 0.0.0-0'
+  chartRef:
+    kind: ExternalArtifact
+    name: cozystack-kubernetes-application-kubevirt-kubernetes-metrics-server
+    namespace: cozy-system
   kubeConfig:
     secretRef:
       name: {{ .Release.Name }}-admin-kubeconfig

packages/apps/kubernetes/templates/helmreleases/monitoring-agents.yaml

@@ -7,17 +7,13 @@ metadata:
   labels:
     cozystack.io/repository: system
     cozystack.io/target-cluster-name: {{ .Release.Name }}
+    sharding.fluxcd.io/key: tenants
 spec:
   releaseName: cozy-monitoring-agents
-  chart:
-    spec:
-      chart: cozy-monitoring-agents
-      reconcileStrategy: Revision
-      sourceRef:
-        kind: HelmRepository
-        name: cozystack-system
-        namespace: cozy-system
-      version: '>= 0.0.0-0'
+  chartRef:
+    kind: ExternalArtifact
+    name: cozystack-kubernetes-application-kubevirt-kubernetes-monitoring-agents
+    namespace: cozy-system
   kubeConfig:
     secretRef:
       name: {{ .Release.Name }}-admin-kubeconfig

packages/apps/kubernetes/templates/helmreleases/prometheus-operator-crds.yaml

@@ -5,17 +5,13 @@ metadata:
   labels:
     cozystack.io/repository: system
     cozystack.io/target-cluster-name: {{ .Release.Name }}
+    sharding.fluxcd.io/key: tenants
 spec:
   releaseName: prometheus-operator-crds
-  chart:
-    spec:
-      chart: cozy-prometheus-operator-crds
-      reconcileStrategy: Revision
-      sourceRef:
-        kind: HelmRepository
-        name: cozystack-system
-        namespace: cozy-system
-      version: '>= 0.0.0-0'
+  chartRef:
+    kind: ExternalArtifact
+    name: cozystack-kubernetes-application-kubevirt-kubernetes-prometheus-operator-crds
+    namespace: cozy-system
   kubeConfig:
     secretRef:
       name: {{ .Release.Name }}-admin-kubeconfig

packages/apps/kubernetes/templates/helmreleases/velero.yaml

@@ -6,17 +6,13 @@ metadata:
   labels:
     cozystack.io/repository: system
     cozystack.io/target-cluster-name: {{ .Release.Name }}
+    sharding.fluxcd.io/key: tenants
 spec:
   releaseName: velero
-  chart:
-    spec:
-      chart: cozy-velero
-      reconcileStrategy: Revision
-      sourceRef:
-        kind: HelmRepository
-        name: cozystack-system
-        namespace: cozy-system
-      version: '>= 0.0.0-0'
+  chartRef:
+    kind: ExternalArtifact
+    name: cozystack-kubernetes-application-kubevirt-kubernetes-velero
+    namespace: cozy-system
   kubeConfig:
     secretRef:
       name: {{ .Release.Name }}-admin-kubeconfig

packages/apps/kubernetes/templates/helmreleases/vertical-pod-autoscaler-crds.yaml

@@ -6,18 +6,14 @@ metadata:
   labels:
     cozystack.io/repository: system
     cozystack.io/target-cluster-name: {{ .Release.Name }}
+    sharding.fluxcd.io/key: tenants
 spec:
   interval: 5m
   releaseName: vertical-pod-autoscaler-crds
-  chart:
-    spec:
-      chart: cozy-vertical-pod-autoscaler-crds
-      reconcileStrategy: Revision
-      sourceRef:
-        kind: HelmRepository
-        name: cozystack-system
-        namespace: cozy-system
-      version: '>= 0.0.0-0'
+  chartRef:
+    kind: ExternalArtifact
+    name: cozystack-kubernetes-application-kubevirt-kubernetes-vertical-pod-autoscaler-crds
+    namespace: cozy-system
   kubeConfig:
     secretRef:
       name: {{ .Release.Name }}-admin-kubeconfig

packages/apps/kubernetes/templates/helmreleases/vertical-pod-autoscaler.yaml

@@ -32,17 +32,13 @@ metadata:
   labels:
     cozystack.io/repository: system
     cozystack.io/target-cluster-name: {{ .Release.Name }}
+    sharding.fluxcd.io/key: tenants
 spec:
   releaseName: vertical-pod-autoscaler
-  chart:
-    spec:
-      chart: cozy-vertical-pod-autoscaler
-      reconcileStrategy: Revision
-      sourceRef:
-        kind: HelmRepository
-        name: cozystack-system
-        namespace: cozy-system
-      version: '>= 0.0.0-0'
+  chartRef:
+    kind: ExternalArtifact
+    name: cozystack-kubernetes-application-kubevirt-kubernetes-vertical-pod-autoscaler
+    namespace: cozy-system
   kubeConfig:
     secretRef:
       name: {{ .Release.Name }}-admin-kubeconfig

packages/apps/kubernetes/templates/helmreleases/victoria-metrics-operator.yaml

@@ -6,17 +6,13 @@ metadata:
   labels:
     cozystack.io/repository: system
     cozystack.io/target-cluster-name: {{ .Release.Name }}
+    sharding.fluxcd.io/key: tenants
 spec:
   releaseName: cozy-victoria-metrics-operator
-  chart:
-    spec:
-      chart: cozy-victoria-metrics-operator
-      reconcileStrategy: Revision
-      sourceRef:
-        kind: HelmRepository
-        name: cozystack-system
-        namespace: cozy-system
-      version: '>= 0.0.0-0'
+  chartRef:
+    kind: ExternalArtifact
+    name: cozystack-kubernetes-application-kubevirt-kubernetes-victoria-metrics-operator
+    namespace: cozy-system
   kubeConfig:
     secretRef:
       name: {{ .Release.Name }}-admin-kubeconfig

packages/apps/kubernetes/templates/helmreleases/volumesnapshot-crd.yaml

@@ -5,17 +5,13 @@ metadata:
   labels:
     cozystack.io/repository: system
     cozystack.io/target-cluster-name: {{ .Release.Name }}
+    sharding.fluxcd.io/key: tenants
 spec:
   releaseName: vsnap-crd
-  chart:
-    spec:
-      chart: cozy-vsnap-crd
-      reconcileStrategy: Revision
-      sourceRef:
-        kind: HelmRepository
-        name: cozystack-system
-        namespace: cozy-system
-      version: '>= 0.0.0-0'
+  chartRef:
+    kind: ExternalArtifact
+    name: cozystack-kubernetes-application-kubevirt-kubernetes-volumesnapshot-crd
+    namespace: cozy-system
   kubeConfig:
     secretRef:
       name: {{ .Release.Name }}-admin-kubeconfig

packages/apps/nats/templates/nats.yaml

@@ -33,16 +33,13 @@ apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:
   name: {{ .Release.Name }}-system
+  labels:
+    sharding.fluxcd.io/key: tenants
 spec:
-  chart:
-    spec:
-      chart: cozy-nats
-      reconcileStrategy: Revision
-      sourceRef:
-        kind: HelmRepository
-        name: cozystack-system
-        namespace: cozy-system
-      version: '>= 0.0.0-0'
+  chartRef:
+    kind: ExternalArtifact
+    name: cozystack-nats-application-default-nats-system
+    namespace: cozy-system
   interval: 5m
   timeout: 10m
   install:

packages/apps/tenant/templates/etcd.yaml

@@ -6,6 +6,7 @@ metadata:
   namespace: {{ include "tenant.name" . }}
   labels:
     cozystack.io/ui: "true"
+    sharding.fluxcd.io/key: tenants
     internal.cozystack.io/tenantmodule: "true"
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/managed-by: {{ .Release.Service }}
@@ -13,15 +14,10 @@ metadata:
     apps.cozystack.io/application.group: apps.cozystack.io
     apps.cozystack.io/application.name: etcd
 spec:
-  chart:
-    spec:
-      chart: etcd
-      reconcileStrategy: Revision
-      sourceRef:
-        kind: HelmRepository
-        name: cozystack-extra
-        namespace: cozy-public
-      version: '>= 0.0.0-0'
+  chartRef:
+    kind: ExternalArtifact
+    name: cozystack-etcd-application-default-etcd
+    namespace: cozy-system
   interval: 5m
   timeout: 10m
   install:

packages/apps/tenant/templates/info.yaml

@@ -5,6 +5,7 @@ metadata:
   namespace: {{ include "tenant.name" . }}
   labels:
     cozystack.io/ui: "true"
+    sharding.fluxcd.io/key: tenants
     internal.cozystack.io/tenantmodule: "true"
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/managed-by: {{ .Release.Service }}
@@ -12,15 +13,10 @@ metadata:
     apps.cozystack.io/application.group: apps.cozystack.io
     apps.cozystack.io/application.name: info
 spec:
-  chart:
-    spec:
-      chart: info
-      reconcileStrategy: Revision
-      sourceRef:
-        kind: HelmRepository
-        name: cozystack-extra
-        namespace: cozy-public
-      version: '>= 0.0.0-0'
+  chartRef:
+    kind: ExternalArtifact
+    name: cozystack-info-application-default-info
+    namespace: cozy-system
   interval: 5m
   timeout: 10m
   install:

packages/apps/tenant/templates/ingress.yaml

@@ -6,6 +6,7 @@ metadata:
   namespace: {{ include "tenant.name" . }}
   labels:
     cozystack.io/ui: "true"
+    sharding.fluxcd.io/key: tenants
     internal.cozystack.io/tenantmodule: "true"
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/managed-by: {{ .Release.Service }}
@@ -13,15 +14,10 @@ metadata:
     apps.cozystack.io/application.group: apps.cozystack.io
     apps.cozystack.io/application.name: ingress
 spec:
-  chart:
-    spec:
-      chart: ingress
-      reconcileStrategy: Revision
-      sourceRef:
-        kind: HelmRepository
-        name: cozystack-extra
-        namespace: cozy-public
-      version: '>= 0.0.0-0'
+  chartRef:
+    kind: ExternalArtifact
+    name: cozystack-ingress-application-default-ingress
+    namespace: cozy-system
   interval: 5m
   timeout: 10m
   install:

packages/apps/tenant/templates/monitoring.yaml

@@ -6,6 +6,7 @@ metadata:
   namespace: {{ include "tenant.name" . }}
   labels:
     cozystack.io/ui: "true"
+    sharding.fluxcd.io/key: tenants
     internal.cozystack.io/tenantmodule: "true"
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/managed-by: {{ .Release.Service }}
@@ -13,15 +14,10 @@ metadata:
     apps.cozystack.io/application.group: apps.cozystack.io
     apps.cozystack.io/application.name: monitoring
 spec:
-  chart:
-    spec:
-      chart: monitoring
-      reconcileStrategy: Revision
-      sourceRef:
-        kind: HelmRepository
-        name: cozystack-extra
-        namespace: cozy-public
-      version: '>= 0.0.0-0'
+  chartRef:
+    kind: ExternalArtifact
+    name: cozystack-monitoring-application-default-monitoring
+    namespace: cozy-system
   interval: 5m
   timeout: 10m
   install:

packages/apps/tenant/templates/seaweedfs.yaml

@@ -6,6 +6,7 @@ metadata:
   namespace: {{ include "tenant.name" . }}
   labels:
     cozystack.io/ui: "true"
+    sharding.fluxcd.io/key: tenants
     internal.cozystack.io/tenantmodule: "true"
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/managed-by: {{ .Release.Service }}
@@ -13,15 +14,10 @@ metadata:
     apps.cozystack.io/application.group: apps.cozystack.io
     apps.cozystack.io/application.name: seaweedfs
 spec:
-  chart:
-    spec:
-      chart: seaweedfs
-      reconcileStrategy: Revision
-      sourceRef:
-        kind: HelmRepository
-        name: cozystack-extra
-        namespace: cozy-public
-      version: '>= 0.0.0-0'
+  chartRef:
+    kind: ExternalArtifact
+    name: cozystack-seaweedfs-application-default-seaweedfs
+    namespace: cozy-system
   interval: 5m
   timeout: 10m
   install:

packages/core/flux-aio/Makefile

@@ -12,23 +12,13 @@ apply:
 diff:
 	cozyhr show -n $(NAMESPACE) $(NAME) --plain | kubectl diff -f-
 
-update: update-old update-new
+MANIFESTS_DIR=../../../internal/fluxinstall/manifests
 
-# TODO: remove old manifest after migration to cozystack-operator
-update-old:
-	timoni bundle build -f flux-aio.cue > templates/fluxcd.yaml
-	yq eval '(select(.kind == "Namespace") | .metadata.labels."pod-security.kubernetes.io/enforce") = "privileged"' -i templates/fluxcd.yaml
-	sed -i templates/fluxcd.yaml \
+update:
+	timoni bundle build -f flux-aio.cue > $(MANIFESTS_DIR)/fluxcd.yaml
+	yq eval '(select(.kind == "Namespace") | .metadata.labels."pod-security.kubernetes.io/enforce") = "privileged"' -i $(MANIFESTS_DIR)/fluxcd.yaml
+	sed -i $(MANIFESTS_DIR)/fluxcd.yaml \
 		-e '/timoni/d' \
 		-e 's|\.cluster\.local\.,||g' -e 's|\.cluster\.local\,||g' -e 's|\.cluster\.local\.||g' \
-		-e '/value: .svc/a \            {{- include "cozy.kubernetes_envs" . | nindent 12 }}' \
-		-e '/hostNetwork: true/i \      dnsPolicy: ClusterFirstWithHostNet'
-
-update-new:
-	timoni bundle build -f flux-aio.cue > ../../../internal/fluxinstall/manifests/fluxcd.yaml
-	yq eval '(select(.kind == "Namespace") | .metadata.labels."pod-security.kubernetes.io/enforce") = "privileged"' -i ../../../internal/fluxinstall/manifests/fluxcd.yaml
-	sed -i ../../../internal/fluxinstall/manifests/fluxcd.yaml \
-		-e '/timoni/d' \
-		-e 's|\.cluster\.local\.,||g' -e 's|\.cluster\.local\,||g' -e 's|\.cluster\.local\.||g'
-	# TODO: solve dns issue with hostNetwork for installing helmreleases in tenant k8s clusters
-	#-e '/hostNetwork: true/i \      dnsPolicy: ClusterFirstWithHostNet' 
+		-e 's|--storage-adv-addr=source-watcher.$$(RUNTIME_NAMESPACE).svc|--storage-adv-addr=flux.$$(RUNTIME_NAMESPACE).svc|'
+	yq eval '.spec.template.spec.containers[0].image = "'"$$(yq eval 'select(.kind == "Deployment" and .metadata.name == "flux") | .spec.template.spec.containers[] | select(.name == "helm-controller").image' $(MANIFESTS_DIR)/fluxcd.yaml)"'"' -i $(MANIFESTS_DIR)/fluxcd-tenants.yaml

packages/core/flux-aio/manifests

@@ -0,0 +1 @@
+../../../internal/fluxinstall/manifests

packages/core/flux-aio/templates/_helpers.tpl

@@ -1,13 +0,0 @@
-{{- define "cozy.kubernetes_envs" }}
-{{- $cozyDeployment := lookup "apps/v1" "Deployment" "cozy-system" "cozystack" }}
-{{- $cozyContainers := dig "spec" "template" "spec" "containers" dict $cozyDeployment }}
-{{- range $cozyContainers }}
-{{- if eq .name "cozystack" }}
-{{- range .env }}
-{{- if has .name (list "KUBERNETES_SERVICE_HOST" "KUBERNETES_SERVICE_PORT") }}
-- {{ toJson . }}
-{{- end }}
-{{- end }}
-{{- end }}
-{{- end }}
-{{- end }}

packages/core/installer/Makefile

@@ -7,51 +7,42 @@ pre-checks:
 	../../../hack/pre-checks.sh
 
 show:
-	cozyhr show -n $(NAMESPACE) $(NAME) --plain
+	cozyhr show --namespace $(NAMESPACE) $(NAME) --plain
 
 apply:
-	cozyhr show -n $(NAMESPACE) $(NAME) --plain | kubectl apply -f-
+	cozyhr show --namespace $(NAMESPACE) $(NAME) --plain | kubectl apply --filename -
 
 diff:
-	cozyhr show -n $(NAMESPACE) $(NAME) --plain | kubectl diff -f -
+	cozyhr show --namespace $(NAMESPACE) $(NAME) --plain | kubectl diff --filename -
 
-image: pre-checks image-cozystack
-
-image-cozystack:
-	docker buildx build -f images/cozystack/Dockerfile ../../.. \
-		--tag $(REGISTRY)/installer:$(call settag,$(TAG)) \
-		--cache-from type=registry,ref=$(REGISTRY)/installer:latest \
-		--cache-to type=inline \
-		--metadata-file images/installer.json \
-		$(BUILDX_ARGS)
-	IMAGE="$(REGISTRY)/installer:$(call settag,$(TAG))@$$(yq e '."containerimage.digest"' images/installer.json -o json -r)" \
-		yq -i '.cozystack.image = strenv(IMAGE)' values.yaml
-	rm -f images/installer.json
+image: pre-checks image-operator image-packages
 
 update-version:
 	TAG="$(call settag,$(TAG))" \
-			  yq -i '.cozystackOperator.cozystackVersion = strenv(TAG)' values.yaml
+		yq --inplace '.cozystackOperator.cozystackVersion = strenv(TAG)' values.yaml
 
 image-operator:
-	docker buildx build -f images/cozystack-operator/Dockerfile ../../.. \
-		 --tag $(REGISTRY)/cozystack-operator:$(call settag,$(TAG)) \
-		 --cache-from type=registry,ref=$(REGISTRY)/cozystack-operator:latest \
-		 --cache-to type=inline \
-		 --metadata-file images/cozystack-operator.json \
-		 $(BUILDX_ARGS)
-	IMAGE="$(REGISTRY)/cozystack-operator:$(call settag,$(TAG))@$$(yq e '."containerimage.digest"' images/cozystack-operator.json -o json -r)" \
-		 yq -i '.cozystackOperator.image = strenv(IMAGE)' values.yaml
+	docker buildx build --file images/cozystack-operator/Dockerfile ../../.. \
+		--tag $(REGISTRY)/cozystack-operator:$(call settag,$(TAG)) \
+		--cache-from type=registry,ref=$(REGISTRY)/cozystack-operator:latest \
+		--cache-to type=inline \
+		--metadata-file images/cozystack-operator.json \
+		$(BUILDX_ARGS)
+	IMAGE="$(REGISTRY)/cozystack-operator:$(call settag,$(TAG))@$$(yq -e '.["containerimage.digest"]' images/cozystack-operator.json -o json -r)" \
+		yq --inplace '.cozystackOperator.image = strenv(IMAGE)' values.yaml
 	rm -f images/cozystack-operator.json
 
-
 image-packages: update-version
 	mkdir -p ../../../_out/assets images
 	flux push artifact \
-		 oci://$(REGISTRY)/platform-packages:$(call settag,$(TAG)) \
-		 --path=../../../packages \
-		 --source=https://github.com/cozystack/cozystack \
-		 --revision="$$(git describe --tags):$$(git rev-parse HEAD)" \
-		 2>&1 | tee images/cozystack-packages.log
-	export REPO="oci://$(REGISTRY)/platform-packages"; \
-	export DIGEST=$$(awk -F@ '/artifact successfully pushed/ {print $$2}' images/cozystack-packages.log; rm -f images/cozystack-packages.log); \
-		 test -n "$$DIGEST" && yq -i '.cozystackOperator.platformSource = (strenv(REPO) + "@" + strenv(DIGEST))' values.yaml
+		oci://$(REGISTRY)/cozystack-packages:$(call settag,$(TAG)) \
+		--path=../../../packages \
+		--source=https://github.com/cozystack/cozystack \
+		--revision="$$(git describe --tags):$$(git rev-parse HEAD)" \
+		2>&1 | tee images/cozystack-packages.log
+	export REPO="oci://$(REGISTRY)/cozystack-packages" \
+	export DIGEST=$$(awk --field-separator @ '/artifact successfully pushed/ {print $$2}' images/cozystack-packages.log) && \
+		rm -f images/cozystack-packages.log && \
+		test -n "$$DIGEST" && \
+		yq --inplace '.cozystackOperator.platformSourceUrl = strenv(REPO)' values.yaml && \
+		yq --inplace '.cozystackOperator.platformSourceRef = "digest=" + strenv(DIGEST)' values.yaml

packages/core/installer/images/cozystack/Dockerfile

@@ -1,41 +0,0 @@
-FROM golang:1.24-alpine AS k8s-await-election-builder
-
-ARG K8S_AWAIT_ELECTION_GITREPO=https://github.com/LINBIT/k8s-await-election
-ARG K8S_AWAIT_ELECTION_VERSION=0.4.1
-
-# TARGETARCH is a docker special variable: https://docs.docker.com/engine/reference/builder/#automatic-platform-args-in-the-global-scope
-ARG TARGETARCH
-
-RUN apk add --no-cache git make
-RUN git clone ${K8S_AWAIT_ELECTION_GITREPO} /usr/local/go/k8s-await-election/ \
- && cd /usr/local/go/k8s-await-election \
- && git reset --hard v${K8S_AWAIT_ELECTION_VERSION} \
- && make \
- && mv ./out/k8s-await-election-${TARGETARCH} /k8s-await-election
-
-FROM golang:1.25-alpine AS builder
-
-ARG TARGETOS
-ARG TARGETARCH
-
-RUN apk add --no-cache make git
-RUN apk add helm --repository=https://dl-cdn.alpinelinux.org/alpine/edge/community
-
-COPY . /src/
-WORKDIR /src
-
-RUN go mod download
-
-FROM alpine:3.22
-
-RUN wget -O- https://github.com/cozystack/cozyhr/raw/refs/heads/main/hack/install.sh | sh -s -- -v 1.5.0
-
-RUN apk add --no-cache make kubectl helm coreutils git jq openssl
-
-COPY --from=builder /src/scripts /cozystack/scripts
-COPY --from=builder /src/packages/core /cozystack/packages/core
-COPY --from=builder /src/packages/system /cozystack/packages/system
-COPY --from=k8s-await-election-builder /k8s-await-election /usr/bin/k8s-await-election
-
-WORKDIR /cozystack
-ENTRYPOINT ["/usr/bin/k8s-await-election", "/cozystack/scripts/installer.sh" ]

packages/core/installer/images/cozystack/Dockerfile.dockerignore

@@ -1 +0,0 @@
-_out

packages/core/installer/templates/cozystack-operator.yaml

@@ -1,4 +1,3 @@
-{{- if .Values.cozystackOperator.enabled }}
 ---
 apiVersion: v1
 kind: Namespace
@@ -78,47 +77,3 @@ spec:
       - key: "node.cilium.io/agent-not-ready"
         operator: "Exists"
         effect: "NoSchedule"
----
-apiVersion: cozystack.io/v1alpha1
-kind: PackageSource
-metadata:
-  name: cozystack.cozystack-platform
-  annotations:
-    operator.cozystack.io/skip-cozystack-values: "true"
-spec:
-  sourceRef:
-    kind: OCIRepository
-    name: cozystack-packages
-    namespace: cozy-system
-    path: /
-  variants:
-  - name: default
-    components:
-    - install:
-        namespace: cozy-system
-        releaseName: cozystack-platform
-      name: cozystack-platform
-      path: core/platform
-      valuesFiles:
-      - values.yaml
-  - name: isp-full
-    components:
-    - install:
-        namespace: cozy-system
-        releaseName: cozystack-platform
-      name: cozystack-platform
-      path: core/platform
-      valuesFiles:
-      - values.yaml
-      - values-isp-full.yaml
-  - name: isp-hosted
-    components:
-    - install:
-        namespace: cozy-system
-        releaseName: cozystack-platform
-      name: cozystack-platform
-      path: core/platform
-      valuesFiles:
-      - values.yaml
-      - values-isp-hosted.yaml
-{{- end }}

packages/core/installer/templates/cozystack.yaml

@@ -1,81 +0,0 @@
-{{- if not .Values.cozystackOperator.enabled }}
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: cozy-system
-  labels:
-    cozystack.io/system: "true"
-    pod-security.kubernetes.io/enforce: privileged
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: cozystack
-  namespace: cozy-system
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: cozystack
-subjects:
-- kind: ServiceAccount
-  name: cozystack
-  namespace: cozy-system
-roleRef:
-  kind: ClusterRole
-  name: cluster-admin
-  apiGroup: rbac.authorization.k8s.io
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: cozystack
-  namespace: cozy-system
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: cozystack
-  strategy:
-    type: RollingUpdate
-    rollingUpdate:
-      maxSurge: 0
-      maxUnavailable: 1
-  template:
-    metadata:
-      labels:
-        app: cozystack
-    spec:
-      hostNetwork: true
-      serviceAccountName: cozystack
-      containers:
-      - name: cozystack
-        image: "{{ .Values.cozystack.image }}"
-        env:
-        - name: KUBERNETES_SERVICE_HOST
-          value: localhost
-        - name: INSTALL_FLUX
-          value: "true"
-        - name: KUBERNETES_SERVICE_PORT
-          value: "7445"
-        - name: K8S_AWAIT_ELECTION_ENABLED
-          value: "1"
-        - name: K8S_AWAIT_ELECTION_NAME
-          value: cozystack
-        - name: K8S_AWAIT_ELECTION_LOCK_NAME
-          value: cozystack
-        - name: K8S_AWAIT_ELECTION_LOCK_NAMESPACE
-          value: cozy-system
-        - name: K8S_AWAIT_ELECTION_IDENTITY
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.name
-      tolerations:
-      - key: "node.kubernetes.io/not-ready"
-        operator: "Exists"
-        effect: "NoSchedule"
-      - key: "node.cilium.io/agent-not-ready"
-        operator: "Exists"
-        effect: "NoSchedule"
-{{- end }}

packages/core/installer/templates/crds.yaml

@@ -1,6 +1,4 @@
-{{- if .Values.cozystackOperator.enabled }}
 {{- range $path, $_ := .Files.Glob "definitions/*.yaml" }}
 ---
 {{ $.Files.Get $path }}
 {{- end }}
-{{- end }}

packages/core/installer/templates/packagesource.yaml

@@ -0,0 +1,43 @@
+---
+apiVersion: cozystack.io/v1alpha1
+kind: PackageSource
+metadata:
+  name: cozystack.cozystack-platform
+  annotations:
+    operator.cozystack.io/skip-cozystack-values: "true"
+spec:
+  sourceRef:
+    kind: OCIRepository
+    name: cozystack-platform
+    namespace: cozy-system
+    path: /
+  variants:
+  - name: default
+    components:
+    - install:
+        namespace: cozy-system
+        releaseName: cozystack-platform
+      name: platform
+      path: core/platform
+      valuesFiles:
+      - values.yaml
+  - name: isp-full
+    components:
+    - install:
+        namespace: cozy-system
+        releaseName: cozystack-platform
+      name: platform
+      path: core/platform
+      valuesFiles:
+      - values.yaml
+      - values-isp-full.yaml
+  - name: isp-hosted
+    components:
+    - install:
+        namespace: cozy-system
+        releaseName: cozystack-platform
+      name: platform
+      path: core/platform
+      valuesFiles:
+      - values.yaml
+      - values-isp-hosted.yaml

packages/core/installer/values.yaml

@@ -1,8 +1,5 @@
-cozystack:
-  image: ghcr.io/cozystack/cozystack/installer:v0.40.2@sha256:146e0de9d1208eba8342277fa08e0588d66e51bc637c6b3add8ef63cc54ef351
 cozystackOperator:
-  enabled: false
-  image: ghcr.io/cozystack/cozystack/cozystack-operator:latest@sha256:f7f6e0fd9e896b7bfa642d0bfa4378bc14e646bc5c2e86e2e09a82770ef33181
-  platformSourceUrl: 'oci://ghcr.io/cozystack/cozystack/platform-packages'
-  platformSourceRef: 'digest=sha256:0576491291b33936cdf770a5c5b5692add97339c1505fc67a92df9d69dfbfdf6'
+  image: ghcr.io/cozystack/cozystack/cozystack-operator:latest@sha256:1e998a7cf2b9ed10b1320d9b3282e9362283fcda524f22fa0ad40579e7e464ff
+  platformSourceUrl: 'oci://ghcr.io/cozystack/cozystack/cozystack-packages'
+  platformSourceRef: 'digest=sha256:319e78e454cdc28e1d6edd701e4b09723bfb12a03c71b77271d136b09002ad7e'
   cozystackVersion: latest

packages/core/platform/Makefile

@@ -4,31 +4,26 @@ NAMESPACE=cozy-system
 include ../../../scripts/common-envs.mk
 
 show:
-	cozyhr show -n $(NAMESPACE) $(NAME) --plain
+	cozyhr show --namespace $(NAMESPACE) $(NAME) --plain
 
 apply:
-	cozyhr show -n $(NAMESPACE) $(NAME) --plain | kubectl apply -f-
-	kubectl delete helmreleases.helm.toolkit.fluxcd.io -l cozystack.io/marked-for-deletion=true -A
+	cozyhr show --namespace $(NAMESPACE) $(NAME) --plain | kubectl apply --filename -
+	kubectl delete helmreleases.helm.toolkit.fluxcd.io --selector cozystack.io/marked-for-deletion=true --all-namespaces
 
 reconcile: apply
 
-namespaces-show:
-	cozyhr show -n $(NAMESPACE) $(NAME) --plain -s templates/namespaces.yaml
-
-namespaces-apply:
-	cozyhr show -n $(NAMESPACE) $(NAME) --plain -s templates/namespaces.yaml | kubectl apply -f-
-
 diff:
-	cozyhr show -n $(NAMESPACE) $(NAME) --plain | kubectl diff -f-
+	cozyhr show --namespace $(NAMESPACE) $(NAME) --plain | kubectl diff --filename -
 
-image: image-assets
-image-assets:
-	docker buildx build -f images/cozystack-assets/Dockerfile ../../.. \
-		--tag $(REGISTRY)/cozystack-assets:$(call settag,$(TAG)) \
-		--cache-from type=registry,ref=$(REGISTRY)/cozystack-assets:latest \
+image: image-migrations
+
+image-migrations:
+	docker buildx build --file images/migrations/Dockerfile . \
+		--tag $(REGISTRY)/platform-migrations:$(call settag,$(TAG)) \
+		--cache-from type=registry,ref=$(REGISTRY)/platform-migrations:latest \
 		--cache-to type=inline \
-		--metadata-file images/cozystack-assets.json \
+		--metadata-file images/migrations.json \
 		$(BUILDX_ARGS)
-	IMAGE="$(REGISTRY)/cozystack-assets:$(call settag,$(TAG))@$$(yq e '."containerimage.digest"' images/cozystack-assets.json -o json -r)" \
-		yq -i '.assets.image = strenv(IMAGE)' values.yaml
-	rm -f images/cozystack-assets.json
+	IMAGE="$(REGISTRY)/platform-migrations:$(call settag,$(TAG))@$$(yq --exit-status '.["containerimage.digest"]' images/migrations.json --output-format json --raw-output)" \
+		yq --inplace '.migrations.image = strenv(IMAGE)' values.yaml
+	rm -f images/migrations.json

packages/core/platform/bundles/distro-full.yaml

@@ -1,435 +0,0 @@
-{{- $cozyConfig := lookup "v1" "ConfigMap" "cozy-system" "cozystack" }}
-{{- $clusterDomain := (index $cozyConfig.data "cluster-domain") | default "cozy.local" }}
-
-releases:
-- name: cilium
-  releaseName: cilium
-  chart: cozy-cilium
-  namespace: cozy-cilium
-  privileged: true
-  dependsOn: []
-  valuesFiles:
-  - values.yaml
-  - values-talos.yaml
-  values:
-    cilium:
-      enableIPv4Masquerade: true
-      enableIdentityMark: true
-      ipv4NativeRoutingCIDR: "{{ index $cozyConfig.data "ipv4-pod-cidr" }}"
-      autoDirectNodeRoutes: true
-      routingMode: native
-
-- name: cilium-networkpolicy
-  releaseName: cilium-networkpolicy
-  chart: cozy-cilium-networkpolicy
-  namespace: cozy-cilium
-  privileged: true
-  dependsOn: [cilium]
-
-- name: cozy-proxy
-  releaseName: cozystack
-  chart: cozy-cozy-proxy
-  namespace: cozy-system
-  optional: true
-  dependsOn: [cilium]
-
-- name: cert-manager-crds
-  releaseName: cert-manager-crds
-  chart: cozy-cert-manager-crds
-  namespace: cozy-cert-manager
-  dependsOn: [cilium]
-
-- name: cozystack-controller
-  releaseName: cozystack-controller
-  chart: cozy-cozystack-controller
-  namespace: cozy-system
-  dependsOn: [cilium]
-  {{- if eq (index $cozyConfig.data "telemetry-enabled") "false" }}
-  values:
-    cozystackController:
-      disableTelemetry: true
-  {{- end }}
-
-- name: lineage-controller-webhook
-  releaseName: lineage-controller-webhook
-  chart: cozy-lineage-controller-webhook
-  namespace: cozy-system
-  dependsOn: [cozystack-controller,cilium,cert-manager]
-
-- name: cozystack-resource-definition-crd
-  releaseName: cozystack-resource-definition-crd
-  chart: cozystack-resource-definition-crd
-  namespace: cozy-system
-  dependsOn: [cilium]
-
-- name: bootbox-rd
-  releaseName: bootbox-rd
-  chart: bootbox-rd
-  namespace: cozy-system
-  dependsOn: [cozystack-resource-definition-crd]
-
-- name: bucket-rd
-  releaseName: bucket-rd
-  chart: bucket-rd
-  namespace: cozy-system
-  dependsOn: [cozystack-resource-definition-crd]
-
-- name: clickhouse-rd
-  releaseName: clickhouse-rd
-  chart: clickhouse-rd
-  namespace: cozy-system
-  dependsOn: [cozystack-resource-definition-crd]
-
-- name: etcd-rd
-  releaseName: etcd-rd
-  chart: etcd-rd
-  namespace: cozy-system
-  dependsOn: [cozystack-resource-definition-crd]
-
-- name: ferretdb-rd
-  releaseName: ferretdb-rd
-  chart: ferretdb-rd
-  namespace: cozy-system
-  dependsOn: [cozystack-resource-definition-crd]
-
-- name: foundationdb-rd
-  releaseName: foundationdb-rd
-  chart: foundationdb-rd
-  namespace: cozy-system
-  dependsOn: [cozystack-resource-definition-crd]
-
-- name: http-cache-rd
-  releaseName: http-cache-rd
-  chart: http-cache-rd
-  namespace: cozy-system
-  dependsOn: [cozystack-resource-definition-crd]
-
-- name: info-rd
-  releaseName: info-rd
-  chart: info-rd
-  namespace: cozy-system
-  dependsOn: [cozystack-resource-definition-crd]
-
-- name: ingress-rd
-  releaseName: ingress-rd
-  chart: ingress-rd
-  namespace: cozy-system
-  dependsOn: [cozystack-resource-definition-crd]
-
-- name: kafka-rd
-  releaseName: kafka-rd
-  chart: kafka-rd
-  namespace: cozy-system
-  dependsOn: [cozystack-resource-definition-crd]
-
-- name: kubernetes-rd
-  releaseName: kubernetes-rd
-  chart: kubernetes-rd
-  namespace: cozy-system
-  dependsOn: [cozystack-resource-definition-crd]
-
-- name: monitoring-rd
-  releaseName: monitoring-rd
-  chart: monitoring-rd
-  namespace: cozy-system
-  dependsOn: [cozystack-resource-definition-crd]
-
-- name: mysql-rd
-  releaseName: mysql-rd
-  chart: mysql-rd
-  namespace: cozy-system
-  dependsOn: [cozystack-resource-definition-crd]
-
-- name: nats-rd
-  releaseName: nats-rd
-  chart: nats-rd
-  namespace: cozy-system
-  dependsOn: [cozystack-resource-definition-crd]
-
-- name: postgres-rd
-  releaseName: postgres-rd
-  chart: postgres-rd
-  namespace: cozy-system
-  dependsOn: [cozystack-resource-definition-crd]
-
-- name: rabbitmq-rd
-  releaseName: rabbitmq-rd
-  chart: rabbitmq-rd
-  namespace: cozy-system
-  dependsOn: [cozystack-resource-definition-crd]
-
-- name: redis-rd
-  releaseName: redis-rd
-  chart: redis-rd
-  namespace: cozy-system
-  dependsOn: [cozystack-resource-definition-crd]
-
-- name: seaweedfs-rd
-  releaseName: seaweedfs-rd
-  chart: seaweedfs-rd
-  namespace: cozy-system
-  dependsOn: [cozystack-resource-definition-crd]
-
-- name: tcp-balancer-rd
-  releaseName: tcp-balancer-rd
-  chart: tcp-balancer-rd
-  namespace: cozy-system
-  dependsOn: [cozystack-resource-definition-crd]
-
-- name: tenant-rd
-  releaseName: tenant-rd
-  chart: tenant-rd
-  namespace: cozy-system
-  dependsOn: [cozystack-resource-definition-crd]
-
-- name: virtual-machine-rd
-  releaseName: virtual-machine-rd
-  chart: virtual-machine-rd
-  namespace: cozy-system
-  dependsOn: [cozystack-resource-definition-crd]
-
-- name: virtualprivatecloud-rd
-  releaseName: virtualprivatecloud-rd
-  chart: virtualprivatecloud-rd
-  namespace: cozy-system
-  dependsOn: [cozystack-resource-definition-crd]
-
-- name: vm-disk-rd
-  releaseName: vm-disk-rd
-  chart: vm-disk-rd
-  namespace: cozy-system
-  dependsOn: [cozystack-resource-definition-crd]
-
-- name: vm-instance-rd
-  releaseName: vm-instance-rd
-  chart: vm-instance-rd
-  namespace: cozy-system
-  dependsOn: [cozystack-resource-definition-crd]
-
-- name: vpn-rd
-  releaseName: vpn-rd
-  chart: vpn-rd
-  namespace: cozy-system
-  dependsOn: [cozystack-resource-definition-crd]
-
-- name: cert-manager
-  releaseName: cert-manager
-  chart: cozy-cert-manager
-  namespace: cozy-cert-manager
-  dependsOn: [cert-manager-crds]
-
-- name: cert-manager-issuers
-  releaseName: cert-manager-issuers
-  chart: cozy-cert-manager-issuers
-  namespace: cozy-cert-manager
-  dependsOn: [cilium,cert-manager]
-
-- name: prometheus-operator-crds
-  releaseName: prometheus-operator-crds
-  chart: cozy-prometheus-operator-crds
-  namespace: cozy-victoria-metrics-operator
-  dependsOn: []
-
-- name: metrics-server
-  releaseName: metrics-server
-  chart: cozy-metrics-server
-  namespace: cozy-monitoring
-  dependsOn: [cilium,prometheus-operator-crds]
-
-- name: victoria-metrics-operator
-  releaseName: victoria-metrics-operator
-  chart: cozy-victoria-metrics-operator
-  namespace: cozy-victoria-metrics-operator
-  optional: true
-  dependsOn: [cilium,cert-manager,prometheus-operator-crds]
-
-- name: monitoring-agents
-  releaseName: monitoring-agents
-  chart: cozy-monitoring-agents
-  namespace: cozy-monitoring
-  privileged: true
-  optional: true
-  dependsOn: [cilium,victoria-metrics-operator,metrics-server]
-  values:
-    scrapeRules:
-      etcd:
-        enabled: true
-
-- name: metallb
-  releaseName: metallb
-  chart: cozy-metallb
-  namespace: cozy-metallb
-  privileged: true
-  dependsOn: [cilium]
-
-- name: etcd-operator
-  releaseName: etcd-operator
-  chart: cozy-etcd-operator
-  namespace: cozy-etcd-operator
-  optional: true
-  dependsOn: [cilium,cert-manager]
-
-- name: grafana-operator
-  releaseName: grafana-operator
-  chart: cozy-grafana-operator
-  namespace: cozy-grafana-operator
-  optional: true
-  dependsOn: [cilium]
-
-- name: mariadb-operator
-  releaseName: mariadb-operator
-  chart: cozy-mariadb-operator
-  namespace: cozy-mariadb-operator
-  optional: true
-  dependsOn: [cilium,cert-manager,victoria-metrics-operator]
-  values:
-    mariadb-operator:
-      clusterName: {{ $clusterDomain }}
-
-- name: postgres-operator
-  releaseName: postgres-operator
-  chart: cozy-postgres-operator
-  namespace: cozy-postgres-operator
-  optional: true
-  dependsOn: [cilium,cert-manager,victoria-metrics-operator]
-
-- name: kafka-operator
-  releaseName: kafka-operator
-  chart: cozy-kafka-operator
-  namespace: cozy-kafka-operator
-  optional: true
-  dependsOn: [cilium,victoria-metrics-operator]
-  values:
-    strimzi-kafka-operator:
-      kubernetesServiceDnsDomain: {{ $clusterDomain }}
-
-- name: clickhouse-operator
-  releaseName: clickhouse-operator
-  chart: cozy-clickhouse-operator
-  namespace: cozy-clickhouse-operator
-  optional: true
-  dependsOn: [cilium,victoria-metrics-operator]
-
-- name: foundationdb-operator
-  releaseName: foundationdb-operator
-  chart: cozy-foundationdb-operator
-  namespace: cozy-foundationdb-operator
-  optional: true
-  dependsOn: [cilium,cert-manager]
-
-- name: rabbitmq-operator
-  releaseName: rabbitmq-operator
-  chart: cozy-rabbitmq-operator
-  namespace: cozy-rabbitmq-operator
-  optional: true
-  dependsOn: [cilium]
-
-- name: redis-operator
-  releaseName: redis-operator
-  chart: cozy-redis-operator
-  namespace: cozy-redis-operator
-  optional: true
-  dependsOn: [cilium]
-
-- name: piraeus-operator
-  releaseName: piraeus-operator
-  chart: cozy-piraeus-operator
-  namespace: cozy-linstor
-  dependsOn: [cilium,cert-manager]
-
-- name: snapshot-controller
-  releaseName: snapshot-controller
-  chart: cozy-snapshot-controller
-  namespace: cozy-snapshot-controller
-  dependsOn: [cilium,cert-manager-issuers]
-
-- name: objectstorage-controller
-  releaseName: objectstorage-controller
-  chart: cozy-objectstorage-controller
-  namespace: cozy-objectstorage-controller
-  optional: true
-  dependsOn: [cilium]
-
-- name: linstor
-  releaseName: linstor
-  chart: cozy-linstor
-  namespace: cozy-linstor
-  privileged: true
-  dependsOn: [piraeus-operator,cilium,cert-manager,snapshot-controller]
-
-- name: linstor-scheduler
-  releaseName: linstor-scheduler
-  chart: cozy-linstor-scheduler
-  namespace: cozy-linstor
-  dependsOn: [linstor,cert-manager]
-
-- name: nfs-driver
-  releaseName: nfs-driver
-  chart: cozy-nfs-driver
-  namespace: cozy-nfs-driver
-  privileged: true
-  dependsOn: [cilium]
-  optional: true
-
-- name: telepresence
-  releaseName: traffic-manager
-  chart: cozy-telepresence
-  namespace: cozy-telepresence
-  optional: true
-  dependsOn: []
-
-- name: external-dns
-  releaseName: external-dns
-  chart: cozy-external-dns
-  namespace: cozy-external-dns
-  optional: true
-  dependsOn: [cilium]
-
-- name: external-secrets-operator
-  releaseName: external-secrets-operator
-  chart: cozy-external-secrets-operator
-  namespace: cozy-external-secrets-operator
-  optional: true
-  dependsOn: [cilium]
-
-- name: keycloak
-  releaseName: keycloak
-  chart: cozy-keycloak
-  namespace: cozy-keycloak
-  optional: true
-  dependsOn: [postgres-operator]
-
-- name: keycloak-operator
-  releaseName: keycloak-operator
-  chart: cozy-keycloak-operator
-  namespace: cozy-keycloak
-  optional: true
-  dependsOn: [keycloak]
-
-- name: bootbox
-  releaseName: bootbox
-  chart: cozy-bootbox
-  namespace: cozy-bootbox
-  privileged: true
-  optional: true
-  dependsOn: [cilium]
-
-- name: reloader
-  releaseName: reloader
-  chart: cozy-reloader
-  namespace: cozy-reloader
-
-- name: velero
-  releaseName: velero
-  chart: cozy-velero
-  namespace: cozy-velero
-  privileged: true
-  optional: true
-  dependsOn: [cilium]
-
-- name: hetzner-robotlb
-  releaseName: robotlb
-  optional: true
-  chart: cozy-hetzner-robotlb
-  namespace: cozy-hetzner-robotlb
-  dependsOn: [cilium]

packages/core/platform/bundles/distro-hosted.yaml

@@ -1,186 +0,0 @@
-{{- $cozyConfig := lookup "v1" "ConfigMap" "cozy-system" "cozystack" }}
-{{- $clusterDomain := (index $cozyConfig.data "cluster-domain") | default "cozy.local" }}
-
-releases:
-- name: cert-manager-crds
-  releaseName: cert-manager-crds
-  chart: cozy-cert-manager-crds
-  namespace: cozy-cert-manager
-  dependsOn: []
-
-- name: cozystack-controller
-  releaseName: cozystack-controller
-  chart: cozy-cozystack-controller
-  namespace: cozy-system
-  {{- if eq (index $cozyConfig.data "telemetry-enabled") "false" }}
-  values:
-    cozystackController:
-      disableTelemetry: true
-  {{- end }}
-
-- name: lineage-controller-webhook
-  releaseName: lineage-controller-webhook
-  chart: cozy-lineage-controller-webhook
-  namespace: cozy-system
-  dependsOn: [cozystack-controller,cert-manager]
-
-- name: cert-manager
-  releaseName: cert-manager
-  chart: cozy-cert-manager
-  namespace: cozy-cert-manager
-  dependsOn: [cert-manager-crds]
-
-- name: cert-manager-issuers
-  releaseName: cert-manager-issuers
-  chart: cozy-cert-manager-issuers
-  namespace: cozy-cert-manager
-  optional: true
-  dependsOn: [cert-manager]
-
-- name: prometheus-operator-crds
-  releaseName: prometheus-operator-crds
-  chart: cozy-prometheus-operator-crds
-  namespace: cozy-victoria-metrics-operator
-  dependsOn: []
-
-- name: metrics-server
-  releaseName: metrics-server
-  chart: cozy-metrics-server
-  namespace: cozy-monitoring
-  dependsOn: [prometheus-operator-crds]
-
-- name: victoria-metrics-operator
-  releaseName: victoria-metrics-operator
-  chart: cozy-victoria-metrics-operator
-  namespace: cozy-victoria-metrics-operator
-  optional: true
-  dependsOn: [prometheus-operator-crds,cert-manager]
-
-- name: monitoring-agents
-  releaseName: monitoring-agents
-  chart: cozy-monitoring-agents
-  namespace: cozy-monitoring
-  privileged: true
-  optional: true
-  dependsOn: [victoria-metrics-operator, metrics-server]
-  values:
-    scrapeRules:
-      etcd:
-        enabled: true
-
-- name: etcd-operator
-  releaseName: etcd-operator
-  chart: cozy-etcd-operator
-  namespace: cozy-etcd-operator
-  optional: true
-  dependsOn: [cert-manager]
-
-- name: grafana-operator
-  releaseName: grafana-operator
-  chart: cozy-grafana-operator
-  namespace: cozy-grafana-operator
-  optional: true
-  dependsOn: []
-
-- name: mariadb-operator
-  releaseName: mariadb-operator
-  chart: cozy-mariadb-operator
-  namespace: cozy-mariadb-operator
-  optional: true
-  dependsOn: [victoria-metrics-operator]
-  values:
-    mariadb-operator:
-      clusterName: {{ $clusterDomain }}
-
-- name: postgres-operator
-  releaseName: postgres-operator
-  chart: cozy-postgres-operator
-  namespace: cozy-postgres-operator
-  optional: true
-  dependsOn: [victoria-metrics-operator]
-
-- name: kafka-operator
-  releaseName: kafka-operator
-  chart: cozy-kafka-operator
-  namespace: cozy-kafka-operator
-  optional: true
-  dependsOn: [victoria-metrics-operator]
-  values:
-    strimzi-kafka-operator:
-      kubernetesServiceDnsDomain: {{ $clusterDomain }}
-
-- name: clickhouse-operator
-  releaseName: clickhouse-operator
-  chart: cozy-clickhouse-operator
-  namespace: cozy-clickhouse-operator
-  optional: true
-  dependsOn: [victoria-metrics-operator]
-
-- name: foundationdb-operator
-  releaseName: foundationdb-operator
-  chart: cozy-foundationdb-operator
-  namespace: cozy-foundationdb-operator
-  optional: true
-  dependsOn: [cert-manager]
-
-- name: rabbitmq-operator
-  releaseName: rabbitmq-operator
-  chart: cozy-rabbitmq-operator
-  namespace: cozy-rabbitmq-operator
-  optional: true
-  dependsOn: []
-
-- name: redis-operator
-  releaseName: redis-operator
-  chart: cozy-redis-operator
-  namespace: cozy-redis-operator
-  optional: true
-  dependsOn: []
-
-- name: telepresence
-  releaseName: traffic-manager
-  chart: cozy-telepresence
-  namespace: cozy-telepresence
-  optional: true
-  dependsOn: []
-
-- name: external-dns
-  releaseName: external-dns
-  chart: cozy-external-dns
-  namespace: cozy-external-dns
-  optional: true
-  dependsOn: []
-
-- name: external-secrets-operator
-  releaseName: external-secrets-operator
-  chart: cozy-external-secrets-operator
-  namespace: cozy-external-secrets-operator
-  optional: true
-  dependsOn: []
-
-- name: keycloak
-  releaseName: keycloak
-  chart: cozy-keycloak
-  namespace: cozy-keycloak
-  optional: true
-  dependsOn: [postgres-operator]
-
-- name: keycloak-operator
-  releaseName: keycloak-operator
-  chart: cozy-keycloak-operator
-  namespace: cozy-keycloak
-  optional: true
-  dependsOn: [keycloak]
-
-- name: velero
-  releaseName: velero
-  chart: cozy-velero
-  namespace: cozy-velero
-  privileged: true
-  optional: true
-
-- name: hetzner-robotlb
-  releaseName: robotlb
-  optional: true
-  chart: cozy-hetzner-robotlb
-  namespace: cozy-hetzner-robotlb

packages/core/platform/bundles/paas-full.yaml

@@ -1,612 +0,0 @@
-{{- $cozyConfig := lookup "v1" "ConfigMap" "cozy-system" "cozystack" }}
-{{- $clusterDomain := (index $cozyConfig.data "cluster-domain") | default "cozy.local" }}
-{{- $oidcEnabled := index $cozyConfig.data "oidc-enabled" }}
-{{- $host := index $cozyConfig.data "root-host" }}
-{{- if not $host }}
-{{- fail "ERROR need root-host in cozystack ConfigMap" }}
-{{- end }}
-{{- $apiServerEndpoint := index $cozyConfig.data "api-server-endpoint" }}
-{{- if not $apiServerEndpoint }}
-{{- fail "ERROR need api-server-endpoint in cozystack ConfigMap" }}
-{{- end }}
-
-releases:
-- name: cilium
-  releaseName: cilium
-  chart: cozy-cilium
-  namespace: cozy-cilium
-  privileged: true
-  dependsOn: []
-  valuesFiles:
-  - values.yaml
-  - values-talos.yaml
-  - values-kubeovn.yaml
-
-- name: cilium-networkpolicy
-  releaseName: cilium-networkpolicy
-  chart: cozy-cilium-networkpolicy
-  namespace: cozy-cilium
-  privileged: true
-  dependsOn: [cilium]
-
-- name: kubeovn
-  releaseName: kubeovn
-  chart: cozy-kubeovn
-  namespace: cozy-kubeovn
-  privileged: true
-  dependsOn: [cilium]
-  values:
-    cozystack:
-      nodesHash: {{ include "cozystack.master-node-ips" . | sha256sum }}
-    kube-ovn:
-      ipv4:
-        POD_CIDR: "{{ index $cozyConfig.data "ipv4-pod-cidr" }}"
-        POD_GATEWAY: "{{ index $cozyConfig.data "ipv4-pod-gateway" }}"
-        SVC_CIDR: "{{ index $cozyConfig.data "ipv4-svc-cidr" }}"
-        JOIN_CIDR: "{{ index $cozyConfig.data "ipv4-join-cidr" }}"
-
-- name: kubeovn-webhook
-  releaseName: kubeovn-webhook
-  chart: cozy-kubeovn-webhook
-  namespace: cozy-kubeovn
-  privileged: true
-  dependsOn: [cilium,kubeovn,cert-manager]
-
-- name: kubeovn-plunger
-  releaseName: kubeovn-plunger
-  chart: cozy-kubeovn-plunger
-  namespace: cozy-kubeovn
-  dependsOn: [cilium,kubeovn]
-
-- name: multus
-  releaseName: multus
-  chart: cozy-multus
-  namespace: cozy-multus
-  privileged: true
-  dependsOn: [cilium,kubeovn]
-
-- name: cozy-proxy
-  releaseName: cozystack
-  chart: cozy-cozy-proxy
-  namespace: cozy-system
-  dependsOn: [cilium,kubeovn,multus]
-
-- name: cert-manager-crds
-  releaseName: cert-manager-crds
-  chart: cozy-cert-manager-crds
-  namespace: cozy-cert-manager
-  dependsOn: []
-
-- name: cozystack-api
-  releaseName: cozystack-api
-  chart: cozy-cozystack-api
-  namespace: cozy-system
-  dependsOn: [cilium,kubeovn,multus,cozystack-controller]
-
-- name: cozystack-controller
-  releaseName: cozystack-controller
-  chart: cozy-cozystack-controller
-  namespace: cozy-system
-  dependsOn: [cilium,kubeovn,multus]
-  {{- if eq (index $cozyConfig.data "telemetry-enabled") "false" }}
-  values:
-    cozystackController:
-      disableTelemetry: true
-  {{- end }}
-
-- name: backup-controller
-  releaseName: backup-controller
-  chart: cozy-backup-controller
-  namespace: cozy-backup-controller
-  dependsOn: [cilium,kubeovn,multus]
-
-- name: lineage-controller-webhook
-  releaseName: lineage-controller-webhook
-  chart: cozy-lineage-controller-webhook
-  namespace: cozy-system
-  dependsOn: [cozystack-controller,cilium,kubeovn,multus,cert-manager]
-
-- name: cozystack-resource-definition-crd
-  releaseName: cozystack-resource-definition-crd
-  chart: cozystack-resource-definition-crd
-  namespace: cozy-system
-  dependsOn: [cilium,kubeovn,multus,cozystack-api,cozystack-controller]
-
-- name: bootbox-rd
-  releaseName: bootbox-rd
-  chart: bootbox-rd
-  namespace: cozy-system
-  dependsOn: [cozystack-resource-definition-crd]
-
-- name: bucket-rd
-  releaseName: bucket-rd
-  chart: bucket-rd
-  namespace: cozy-system
-  dependsOn: [cozystack-resource-definition-crd]
-
-- name: clickhouse-rd
-  releaseName: clickhouse-rd
-  chart: clickhouse-rd
-  namespace: cozy-system
-  dependsOn: [cozystack-resource-definition-crd]
-
-- name: etcd-rd
-  releaseName: etcd-rd
-  chart: etcd-rd
-  namespace: cozy-system
-  dependsOn: [cozystack-resource-definition-crd]
-
-- name: ferretdb-rd
-  releaseName: ferretdb-rd
-  chart: ferretdb-rd
-  namespace: cozy-system
-  dependsOn: [cozystack-resource-definition-crd]
-
-- name: foundationdb-rd
-  releaseName: foundationdb-rd
-  chart: foundationdb-rd
-  namespace: cozy-system
-  dependsOn: [cozystack-resource-definition-crd]
-
-- name: http-cache-rd
-  releaseName: http-cache-rd
-  chart: http-cache-rd
-  namespace: cozy-system
-  dependsOn: [cozystack-resource-definition-crd]
-
-- name: info-rd
-  releaseName: info-rd
-  chart: info-rd
-  namespace: cozy-system
-  dependsOn: [cozystack-resource-definition-crd]
-
-- name: ingress-rd
-  releaseName: ingress-rd
-  chart: ingress-rd
-  namespace: cozy-system
-  dependsOn: [cozystack-resource-definition-crd]
-
-- name: kafka-rd
-  releaseName: kafka-rd
-  chart: kafka-rd
-  namespace: cozy-system
-  dependsOn: [cozystack-resource-definition-crd]
-
-- name: kubernetes-rd
-  releaseName: kubernetes-rd
-  chart: kubernetes-rd
-  namespace: cozy-system
-  dependsOn: [cozystack-resource-definition-crd]
-
-- name: monitoring-rd
-  releaseName: monitoring-rd
-  chart: monitoring-rd
-  namespace: cozy-system
-  dependsOn: [cozystack-resource-definition-crd]
-
-- name: mysql-rd
-  releaseName: mysql-rd
-  chart: mysql-rd
-  namespace: cozy-system
-  dependsOn: [cozystack-resource-definition-crd]
-
-- name: nats-rd
-  releaseName: nats-rd
-  chart: nats-rd
-  namespace: cozy-system
-  dependsOn: [cozystack-resource-definition-crd]
-
-- name: postgres-rd
-  releaseName: postgres-rd
-  chart: postgres-rd
-  namespace: cozy-system
-  dependsOn: [cozystack-resource-definition-crd]
-
-- name: rabbitmq-rd
-  releaseName: rabbitmq-rd
-  chart: rabbitmq-rd
-  namespace: cozy-system
-  dependsOn: [cozystack-resource-definition-crd]
-
-- name: redis-rd
-  releaseName: redis-rd
-  chart: redis-rd
-  namespace: cozy-system
-  dependsOn: [cozystack-resource-definition-crd]
-
-- name: seaweedfs-rd
-  releaseName: seaweedfs-rd
-  chart: seaweedfs-rd
-  namespace: cozy-system
-  dependsOn: [cozystack-resource-definition-crd]
-
-- name: tcp-balancer-rd
-  releaseName: tcp-balancer-rd
-  chart: tcp-balancer-rd
-  namespace: cozy-system
-  dependsOn: [cozystack-resource-definition-crd]
-
-- name: tenant-rd
-  releaseName: tenant-rd
-  chart: tenant-rd
-  namespace: cozy-system
-  dependsOn: [cozystack-resource-definition-crd]
-
-- name: virtual-machine-rd
-  releaseName: virtual-machine-rd
-  chart: virtual-machine-rd
-  namespace: cozy-system
-  dependsOn: [cozystack-resource-definition-crd]
-
-- name: virtualprivatecloud-rd
-  releaseName: virtualprivatecloud-rd
-  chart: virtualprivatecloud-rd
-  namespace: cozy-system
-  dependsOn: [cozystack-resource-definition-crd]
-
-- name: vm-disk-rd
-  releaseName: vm-disk-rd
-  chart: vm-disk-rd
-  namespace: cozy-system
-  dependsOn: [cozystack-resource-definition-crd]
-
-- name: vm-instance-rd
-  releaseName: vm-instance-rd
-  chart: vm-instance-rd
-  namespace: cozy-system
-  dependsOn: [cozystack-resource-definition-crd]
-
-- name: vpn-rd
-  releaseName: vpn-rd
-  chart: vpn-rd
-  namespace: cozy-system
-  dependsOn: [cozystack-resource-definition-crd]
-
-- name: cert-manager
-  releaseName: cert-manager
-  chart: cozy-cert-manager
-  namespace: cozy-cert-manager
-  dependsOn: [cilium,kubeovn,multus,cert-manager-crds]
-
-- name: cert-manager-issuers
-  releaseName: cert-manager-issuers
-  chart: cozy-cert-manager-issuers
-  namespace: cozy-cert-manager
-  dependsOn: [cert-manager]
-
-- name: prometheus-operator-crds
-  releaseName: prometheus-operator-crds
-  chart: cozy-prometheus-operator-crds
-  namespace: cozy-victoria-metrics-operator
-  dependsOn: []
-
-- name: metrics-server
-  releaseName: metrics-server
-  chart: cozy-metrics-server
-  namespace: cozy-monitoring
-  dependsOn: [cilium,kubeovn,multus,prometheus-operator-crds]
-
-- name: victoria-metrics-operator
-  releaseName: victoria-metrics-operator
-  chart: cozy-victoria-metrics-operator
-  namespace: cozy-victoria-metrics-operator
-  dependsOn: [cilium,kubeovn,multus,cert-manager,prometheus-operator-crds]
-
-- name: monitoring-agents
-  releaseName: monitoring-agents
-  chart: cozy-monitoring-agents
-  namespace: cozy-monitoring
-  privileged: true
-  dependsOn: [victoria-metrics-operator,vertical-pod-autoscaler-crds,metrics-server]
-  values:
-    scrapeRules:
-      etcd:
-        enabled: true
-
-- name: kubevirt-operator
-  releaseName: kubevirt-operator
-  chart: cozy-kubevirt-operator
-  namespace: cozy-kubevirt
-  dependsOn: [cilium,kubeovn,multus,victoria-metrics-operator]
-
-- name: kubevirt
-  releaseName: kubevirt
-  chart: cozy-kubevirt
-  namespace: cozy-kubevirt
-  privileged: true
-  dependsOn: [cilium,kubeovn,multus,kubevirt-operator]
-  {{- $cpuAllocationRatio := index $cozyConfig.data "cpu-allocation-ratio" }}
-  {{- if $cpuAllocationRatio }}
-  values:
-    cpuAllocationRatio: {{ $cpuAllocationRatio }}
-  {{- end }}
-
-- name: kubevirt-instancetypes
-  releaseName: kubevirt-instancetypes
-  chart: cozy-kubevirt-instancetypes
-  namespace: cozy-kubevirt
-  dependsOn: [cilium,kubeovn,multus,kubevirt-operator,kubevirt]
-
-- name: kubevirt-cdi-operator
-  releaseName: kubevirt-cdi-operator
-  chart: cozy-kubevirt-cdi-operator
-  namespace: cozy-kubevirt-cdi
-  dependsOn: [cilium,kubeovn,multus]
-
-- name: kubevirt-cdi
-  releaseName: kubevirt-cdi
-  chart: cozy-kubevirt-cdi
-  namespace: cozy-kubevirt-cdi
-  dependsOn: [cilium,kubeovn,multus,kubevirt-cdi-operator]
-
-- name: gpu-operator
-  releaseName: gpu-operator
-  chart: cozy-gpu-operator
-  namespace: cozy-gpu-operator
-  privileged: true
-  optional: true
-  dependsOn: [cilium,kubeovn,multus]
-  valuesFiles:
-  - values.yaml
-  - values-talos.yaml
-
-- name: metallb
-  releaseName: metallb
-  chart: cozy-metallb
-  namespace: cozy-metallb
-  privileged: true
-  dependsOn: [cilium,kubeovn,multus]
-
-- name: etcd-operator
-  releaseName: etcd-operator
-  chart: cozy-etcd-operator
-  namespace: cozy-etcd-operator
-  dependsOn: [cilium,kubeovn,multus,cert-manager]
-
-- name: grafana-operator
-  releaseName: grafana-operator
-  chart: cozy-grafana-operator
-  namespace: cozy-grafana-operator
-  dependsOn: [cilium,kubeovn,multus]
-
-- name: mariadb-operator
-  releaseName: mariadb-operator
-  chart: cozy-mariadb-operator
-  namespace: cozy-mariadb-operator
-  dependsOn: [cilium,kubeovn,multus,cert-manager,victoria-metrics-operator]
-  values:
-    mariadb-operator:
-      clusterName: {{ $clusterDomain }}
-
-- name: postgres-operator
-  releaseName: postgres-operator
-  chart: cozy-postgres-operator
-  namespace: cozy-postgres-operator
-  dependsOn: [cilium,kubeovn,multus,cert-manager]
-
-- name: kafka-operator
-  releaseName: kafka-operator
-  chart: cozy-kafka-operator
-  namespace: cozy-kafka-operator
-  dependsOn: [cilium,kubeovn,multus,victoria-metrics-operator]
-  values:
-    strimzi-kafka-operator:
-      kubernetesServiceDnsDomain: {{ $clusterDomain }}
-
-- name: clickhouse-operator
-  releaseName: clickhouse-operator
-  chart: cozy-clickhouse-operator
-  namespace: cozy-clickhouse-operator
-  dependsOn: [cilium,kubeovn,multus,victoria-metrics-operator]
-
-- name: foundationdb-operator
-  releaseName: foundationdb-operator
-  chart: cozy-foundationdb-operator
-  namespace: cozy-foundationdb-operator
-  dependsOn: [cilium,kubeovn,multus,cert-manager]
-
-- name: rabbitmq-operator
-  releaseName: rabbitmq-operator
-  chart: cozy-rabbitmq-operator
-  namespace: cozy-rabbitmq-operator
-  dependsOn: [cilium,kubeovn,multus]
-
-- name: redis-operator
-  releaseName: redis-operator
-  chart: cozy-redis-operator
-  namespace: cozy-redis-operator
-  dependsOn: [cilium,kubeovn,multus]
-
-- name: piraeus-operator
-  releaseName: piraeus-operator
-  chart: cozy-piraeus-operator
-  namespace: cozy-linstor
-  dependsOn: [cilium,kubeovn,multus,cert-manager,victoria-metrics-operator]
-
-- name: linstor
-  releaseName: linstor
-  chart: cozy-linstor
-  namespace: cozy-linstor
-  privileged: true
-  dependsOn: [piraeus-operator,cilium,kubeovn,multus,cert-manager,snapshot-controller]
-
-- name: linstor-scheduler
-  releaseName: linstor-scheduler
-  chart: cozy-linstor-scheduler
-  namespace: cozy-linstor
-  dependsOn: [linstor,cert-manager]
-
-- name: nfs-driver
-  releaseName: nfs-driver
-  chart: cozy-nfs-driver
-  namespace: cozy-nfs-driver
-  privileged: true
-  dependsOn: [cilium,kubeovn,multus]
-  optional: true
-
-- name: snapshot-controller
-  releaseName: snapshot-controller
-  chart: cozy-snapshot-controller
-  namespace: cozy-snapshot-controller
-  dependsOn: [cilium,kubeovn,multus,cert-manager-issuers]
-
-- name: objectstorage-controller
-  releaseName: objectstorage-controller
-  chart: cozy-objectstorage-controller
-  namespace: cozy-objectstorage-controller
-  dependsOn: [cilium,kubeovn,multus]
-
-- name: telepresence
-  releaseName: traffic-manager
-  chart: cozy-telepresence
-  namespace: cozy-telepresence
-  optional: true
-  dependsOn: [cilium,kubeovn,multus]
-
-- name: dashboard
-  releaseName: dashboard
-  chart: cozy-dashboard
-  namespace: cozy-dashboard
-  values:
-    {{- $dashboardKCconfig := lookup "v1" "ConfigMap" "cozy-dashboard" "kubeapps-auth-config" }}
-    {{- $dashboardKCValues := dig "data" "values.yaml" "" $dashboardKCconfig | fromYaml }}
-    {{- toYaml (deepCopy $dashboardKCValues | mergeOverwrite (fromYaml (include "cozystack.defaultDashboardValues" .))) | nindent 4 }}
-  dependsOn:
-  - cilium
-  - kubeovn
-  - multus
-  {{- if eq $oidcEnabled "true" }}
-  - keycloak-configure
-  {{- end }}
-
-- name: kamaji
-  releaseName: kamaji
-  chart: cozy-kamaji
-  namespace: cozy-kamaji
-  dependsOn: [cilium,kubeovn,multus,cert-manager]
-
-- name: capi-operator
-  releaseName: capi-operator
-  chart: cozy-capi-operator
-  namespace: cozy-cluster-api
-  privileged: true
-  dependsOn: [cilium,kubeovn,multus,cert-manager]
-
-- name: capi-providers-bootstrap
-  releaseName: capi-providers-bootstrap
-  chart: cozy-capi-providers-bootstrap
-  namespace: cozy-cluster-api
-  privileged: true
-  dependsOn: [cilium,kubeovn,multus,capi-operator]
-
-- name: capi-providers-core
-  releaseName: capi-providers-core
-  chart: cozy-capi-providers-core
-  namespace: cozy-cluster-api
-  privileged: true
-  dependsOn: [cilium,kubeovn,multus,capi-operator]
-
-- name: capi-providers-cpprovider
-  releaseName: capi-providers-cpprovider
-  chart: cozy-capi-providers-cpprovider
-  namespace: cozy-cluster-api
-  privileged: true
-  dependsOn: [cilium,kubeovn,multus,capi-operator]
-
-- name: capi-providers-infraprovider
-  releaseName: capi-providers-infraprovider
-  chart: cozy-capi-providers-infraprovider
-  namespace: cozy-cluster-api
-  privileged: true
-  dependsOn: [cilium,kubeovn,multus,capi-operator]
-
-- name: external-dns
-  releaseName: external-dns
-  chart: cozy-external-dns
-  namespace: cozy-external-dns
-  optional: true
-  dependsOn: [cilium,kubeovn,multus]
-
-- name: external-secrets-operator
-  releaseName: external-secrets-operator
-  chart: cozy-external-secrets-operator
-  namespace: cozy-external-secrets-operator
-  optional: true
-  dependsOn: [cilium,kubeovn,multus]
-
-- name: bootbox
-  releaseName: bootbox
-  chart: cozy-bootbox
-  namespace: cozy-bootbox
-  privileged: true
-  optional: true
-  dependsOn: [cilium,kubeovn,multus]
-
-{{- if $oidcEnabled }}
-- name: keycloak
-  releaseName: keycloak
-  chart: cozy-keycloak
-  namespace: cozy-keycloak
-  dependsOn: [postgres-operator]
-
-- name: keycloak-operator
-  releaseName: keycloak-operator
-  chart: cozy-keycloak-operator
-  namespace: cozy-keycloak
-  dependsOn: [keycloak]
-
-- name: keycloak-configure
-  releaseName: keycloak-configure
-  chart: cozy-keycloak-configure
-  namespace: cozy-keycloak
-  dependsOn: [keycloak-operator]
-  values:
-    cozystack:
-      configHash: {{ $cozyConfig | toJson | sha256sum }}
-{{- end }}
-
-- name: goldpinger
-  releaseName: goldpinger
-  chart: cozy-goldpinger
-  namespace: cozy-goldpinger
-  privileged: true
-  dependsOn: [monitoring-agents]
-
-- name: vertical-pod-autoscaler
-  releaseName: vertical-pod-autoscaler
-  chart: cozy-vertical-pod-autoscaler
-  namespace: cozy-vertical-pod-autoscaler
-  privileged: true
-  dependsOn: [monitoring-agents]
-  values:
-    vertical-pod-autoscaler:
-      recommender:
-        extraArgs:
-          prometheus-address: http://vmselect-shortterm.tenant-root.svc.{{ $clusterDomain }}:8481/select/0/prometheus/
-
-- name: vertical-pod-autoscaler-crds
-  releaseName: vertical-pod-autoscaler-crds
-  chart: cozy-vertical-pod-autoscaler-crds
-  namespace: cozy-vertical-pod-autoscaler
-  privileged: true
-  dependsOn: []
-
-- name: reloader
-  releaseName: reloader
-  chart: cozy-reloader
-  namespace: cozy-reloader
-
-- name: velero
-  releaseName: velero
-  chart: cozy-velero
-  namespace: cozy-velero
-  privileged: true
-  optional: true
-  dependsOn: [monitoring-agents]
-
-- name: hetzner-robotlb
-  releaseName: robotlb
-  optional: true
-  chart: cozy-hetzner-robotlb
-  namespace: cozy-hetzner-robotlb
-  dependsOn: [cilium, kubeovn]

packages/core/platform/bundles/paas-hosted.yaml

@@ -1,417 +0,0 @@
-{{- $cozyConfig := lookup "v1" "ConfigMap" "cozy-system" "cozystack" }}
-{{- $clusterDomain := (index $cozyConfig.data "cluster-domain") | default "cozy.local" }}
-{{- $oidcEnabled := index $cozyConfig.data "oidc-enabled" }}
-{{- $host := index $cozyConfig.data "root-host" }}
-{{- if not $host }}
-{{- fail "ERROR need root-host in cozystack ConfigMap" }}
-{{- end }}
-{{- $apiServerEndpoint := index $cozyConfig.data "api-server-endpoint" }}
-{{- if not $apiServerEndpoint }}
-{{- fail "ERROR need api-server-endpoint in cozystack ConfigMap" }}
-{{- end }}
-
-releases:
-- name: cert-manager-crds
-  releaseName: cert-manager-crds
-  chart: cozy-cert-manager-crds
-  namespace: cozy-cert-manager
-  dependsOn: []
-
-- name: cozystack-api
-  releaseName: cozystack-api
-  chart: cozy-cozystack-api
-  namespace: cozy-system
-  dependsOn: [cozystack-controller]
-  values:
-    cozystackAPI:
-      localK8sAPIEndpoint:
-        enabled: false
-
-- name: cozystack-controller
-  releaseName: cozystack-controller
-  chart: cozy-cozystack-controller
-  namespace: cozy-system
-  dependsOn: []
-  {{- if eq (index $cozyConfig.data "telemetry-enabled") "false" }}
-  values:
-    cozystackController:
-      disableTelemetry: true
-  {{- end }}
-
-- name: backup-controller
-  releaseName: backup-controller
-  chart: cozy-backup-controller
-  namespace: cozy-backup-controller
-
-- name: lineage-controller-webhook
-  releaseName: lineage-controller-webhook
-  chart: cozy-lineage-controller-webhook
-  namespace: cozy-system
-  dependsOn: [cozystack-controller,cert-manager]
-
-- name: cozystack-resource-definition-crd
-  releaseName: cozystack-resource-definition-crd
-  chart: cozystack-resource-definition-crd
-  namespace: cozy-system
-  dependsOn: [cozystack-api,cozystack-controller]
-
-- name: bootbox-rd
-  releaseName: bootbox-rd
-  chart: bootbox-rd
-  namespace: cozy-system
-  dependsOn: [cozystack-resource-definition-crd]
-
-- name: bucket-rd
-  releaseName: bucket-rd
-  chart: bucket-rd
-  namespace: cozy-system
-  dependsOn: [cozystack-resource-definition-crd]
-
-- name: clickhouse-rd
-  releaseName: clickhouse-rd
-  chart: clickhouse-rd
-  namespace: cozy-system
-  dependsOn: [cozystack-resource-definition-crd]
-
-- name: etcd-rd
-  releaseName: etcd-rd
-  chart: etcd-rd
-  namespace: cozy-system
-  dependsOn: [cozystack-resource-definition-crd]
-
-- name: ferretdb-rd
-  releaseName: ferretdb-rd
-  chart: ferretdb-rd
-  namespace: cozy-system
-  dependsOn: [cozystack-resource-definition-crd]
-
-- name: foundationdb-rd
-  releaseName: foundationdb-rd
-  chart: foundationdb-rd
-  namespace: cozy-system
-  dependsOn: [cozystack-resource-definition-crd]
-
-- name: http-cache-rd
-  releaseName: http-cache-rd
-  chart: http-cache-rd
-  namespace: cozy-system
-  dependsOn: [cozystack-resource-definition-crd]
-
-- name: info-rd
-  releaseName: info-rd
-  chart: info-rd
-  namespace: cozy-system
-  dependsOn: [cozystack-resource-definition-crd]
-
-- name: ingress-rd
-  releaseName: ingress-rd
-  chart: ingress-rd
-  namespace: cozy-system
-  dependsOn: [cozystack-resource-definition-crd]
-
-- name: kafka-rd
-  releaseName: kafka-rd
-  chart: kafka-rd
-  namespace: cozy-system
-  dependsOn: [cozystack-resource-definition-crd]
-
-- name: kubernetes-rd
-  releaseName: kubernetes-rd
-  chart: kubernetes-rd
-  namespace: cozy-system
-  dependsOn: [cozystack-resource-definition-crd]
-
-- name: monitoring-rd
-  releaseName: monitoring-rd
-  chart: monitoring-rd
-  namespace: cozy-system
-  dependsOn: [cozystack-resource-definition-crd]
-
-- name: mysql-rd
-  releaseName: mysql-rd
-  chart: mysql-rd
-  namespace: cozy-system
-  dependsOn: [cozystack-resource-definition-crd]
-
-- name: nats-rd
-  releaseName: nats-rd
-  chart: nats-rd
-  namespace: cozy-system
-  dependsOn: [cozystack-resource-definition-crd]
-
-- name: postgres-rd
-  releaseName: postgres-rd
-  chart: postgres-rd
-  namespace: cozy-system
-  dependsOn: [cozystack-resource-definition-crd]
-
-- name: rabbitmq-rd
-  releaseName: rabbitmq-rd
-  chart: rabbitmq-rd
-  namespace: cozy-system
-  dependsOn: [cozystack-resource-definition-crd]
-
-- name: redis-rd
-  releaseName: redis-rd
-  chart: redis-rd
-  namespace: cozy-system
-  dependsOn: [cozystack-resource-definition-crd]
-
-- name: seaweedfs-rd
-  releaseName: seaweedfs-rd
-  chart: seaweedfs-rd
-  namespace: cozy-system
-  dependsOn: [cozystack-resource-definition-crd]
-
-- name: tcp-balancer-rd
-  releaseName: tcp-balancer-rd
-  chart: tcp-balancer-rd
-  namespace: cozy-system
-  dependsOn: [cozystack-resource-definition-crd]
-
-- name: tenant-rd
-  releaseName: tenant-rd
-  chart: tenant-rd
-  namespace: cozy-system
-  dependsOn: [cozystack-resource-definition-crd]
-
-- name: virtual-machine-rd
-  releaseName: virtual-machine-rd
-  chart: virtual-machine-rd
-  namespace: cozy-system
-  dependsOn: [cozystack-resource-definition-crd]
-
-- name: virtualprivatecloud-rd
-  releaseName: virtualprivatecloud-rd
-  chart: virtualprivatecloud-rd
-  namespace: cozy-system
-  dependsOn: [cozystack-resource-definition-crd]
-
-- name: vm-disk-rd
-  releaseName: vm-disk-rd
-  chart: vm-disk-rd
-  namespace: cozy-system
-  dependsOn: [cozystack-resource-definition-crd]
-
-- name: vm-instance-rd
-  releaseName: vm-instance-rd
-  chart: vm-instance-rd
-  namespace: cozy-system
-  dependsOn: [cozystack-resource-definition-crd]
-
-- name: vpn-rd
-  releaseName: vpn-rd
-  chart: vpn-rd
-  namespace: cozy-system
-  dependsOn: [cozystack-resource-definition-crd]
-
-- name: cert-manager
-  releaseName: cert-manager
-  chart: cozy-cert-manager
-  namespace: cozy-cert-manager
-  dependsOn: [cert-manager-crds]
-
-- name: cert-manager-issuers
-  releaseName: cert-manager-issuers
-  chart: cozy-cert-manager-issuers
-  namespace: cozy-cert-manager
-  dependsOn: [cert-manager]
-
-- name: prometheus-operator-crds
-  releaseName: prometheus-operator-crds
-  chart: cozy-prometheus-operator-crds
-  namespace: cozy-victoria-metrics-operator
-  dependsOn: []
-
-- name: metrics-server
-  releaseName: metrics-server
-  chart: cozy-metrics-server
-  namespace: cozy-monitoring
-  dependsOn: [prometheus-operator-crds]
-
-- name: victoria-metrics-operator
-  releaseName: victoria-metrics-operator
-  chart: cozy-victoria-metrics-operator
-  namespace: cozy-victoria-metrics-operator
-  dependsOn: [cert-manager,prometheus-operator-crds]
-
-- name: monitoring-agents
-  releaseName: monitoring-agents
-  chart: cozy-monitoring-agents
-  namespace: cozy-monitoring
-  privileged: true
-  dependsOn: [victoria-metrics-operator, vertical-pod-autoscaler-crds, metrics-server]
-  values:
-    scrapeRules:
-      etcd:
-        enabled: true
-
-- name: etcd-operator
-  releaseName: etcd-operator
-  chart: cozy-etcd-operator
-  namespace: cozy-etcd-operator
-  dependsOn: [cert-manager]
-
-- name: grafana-operator
-  releaseName: grafana-operator
-  chart: cozy-grafana-operator
-  namespace: cozy-grafana-operator
-  dependsOn: []
-
-- name: mariadb-operator
-  releaseName: mariadb-operator
-  chart: cozy-mariadb-operator
-  namespace: cozy-mariadb-operator
-  dependsOn: [cert-manager,victoria-metrics-operator]
-  values:
-    mariadb-operator:
-      clusterName: {{ $clusterDomain }}
-
-- name: postgres-operator
-  releaseName: postgres-operator
-  chart: cozy-postgres-operator
-  namespace: cozy-postgres-operator
-  dependsOn: [cert-manager,victoria-metrics-operator]
-
-- name: kafka-operator
-  releaseName: kafka-operator
-  chart: cozy-kafka-operator
-  namespace: cozy-kafka-operator
-  dependsOn: [victoria-metrics-operator]
-  values:
-    strimzi-kafka-operator:
-      kubernetesServiceDnsDomain: {{ $clusterDomain }}
-
-- name: clickhouse-operator
-  releaseName: clickhouse-operator
-  chart: cozy-clickhouse-operator
-  namespace: cozy-clickhouse-operator
-  dependsOn: [victoria-metrics-operator]
-
-- name: foundationdb-operator
-  releaseName: foundationdb-operator
-  chart: cozy-foundationdb-operator
-  namespace: cozy-foundationdb-operator
-  dependsOn: [cert-manager]
-
-- name: rabbitmq-operator
-  releaseName: rabbitmq-operator
-  chart: cozy-rabbitmq-operator
-  namespace: cozy-rabbitmq-operator
-  dependsOn: []
-
-- name: redis-operator
-  releaseName: redis-operator
-  chart: cozy-redis-operator
-  namespace: cozy-redis-operator
-  dependsOn: []
-
-- name: piraeus-operator
-  releaseName: piraeus-operator
-  chart: cozy-piraeus-operator
-  namespace: cozy-linstor
-  dependsOn: [cert-manager]
-
-- name: objectstorage-controller
-  releaseName: objectstorage-controller
-  chart: cozy-objectstorage-controller
-  namespace: cozy-objectstorage-controller
-  dependsOn: []
-
-- name: telepresence
-  releaseName: traffic-manager
-  chart: cozy-telepresence
-  namespace: cozy-telepresence
-  optional: true
-  dependsOn: []
-
-- name: external-dns
-  releaseName: external-dns
-  chart: cozy-external-dns
-  namespace: cozy-external-dns
-  optional: true
-  dependsOn: []
-
-- name: external-secrets-operator
-  releaseName: external-secrets-operator
-  chart: cozy-external-secrets-operator
-  namespace: cozy-external-secrets-operator
-  optional: true
-  dependsOn: []
-
-- name: dashboard
-  releaseName: dashboard
-  chart: cozy-dashboard
-  namespace: cozy-dashboard
-  values:
-    {{- $dashboardKCconfig := lookup "v1" "ConfigMap" "cozy-dashboard" "kubeapps-auth-config" }}
-    {{- $dashboardKCValues := dig "data" "values.yaml" (dict) $dashboardKCconfig }}
-    {{- toYaml (deepCopy $dashboardKCValues | mergeOverwrite (fromYaml (include "cozystack.defaultDashboardValues" .))) | nindent 4 }}
-  {{- if eq $oidcEnabled "true" }}
-  dependsOn: [keycloak-configure,cozystack-api]
-  {{- else }}
-  dependsOn: []
-  {{- end }}
-
-{{- if $oidcEnabled }}
-- name: keycloak
-  releaseName: keycloak
-  chart: cozy-keycloak
-  namespace: cozy-keycloak
-  dependsOn: [postgres-operator]
-
-- name: keycloak-operator
-  releaseName: keycloak-operator
-  chart: cozy-keycloak-operator
-  namespace: cozy-keycloak
-  dependsOn: [keycloak]
-
-- name: keycloak-configure
-  releaseName: keycloak-configure
-  chart: cozy-keycloak-configure
-  namespace: cozy-keycloak
-  dependsOn: [keycloak-operator]
-  values:
-    cozystack:
-      configHash: {{ $cozyConfig | toJson | sha256sum }}
-{{- end }}
-
-- name: goldpinger
-  releaseName: goldpinger
-  chart: cozy-goldpinger
-  namespace: cozy-goldpinger
-  privileged: true
-  dependsOn: [monitoring-agents]
-
-- name: vertical-pod-autoscaler
-  releaseName: vertical-pod-autoscaler
-  chart: cozy-vertical-pod-autoscaler
-  namespace: cozy-vertical-pod-autoscaler
-  privileged: true
-  dependsOn: [monitoring-agents]
-  values:
-    vertical-pod-autoscaler:
-      recommender:
-        extraArgs:
-          prometheus-address: http://vmselect-shortterm.tenant-root.svc.{{ $clusterDomain }}:8481/select/0/prometheus/
-
-- name: vertical-pod-autoscaler-crds
-  releaseName: vertical-pod-autoscaler-crds
-  chart: cozy-vertical-pod-autoscaler-crds
-  namespace: cozy-vertical-pod-autoscaler
-  privileged: true
-  dependsOn: []
-
-- name: velero
-  releaseName: velero
-  chart: cozy-velero
-  namespace: cozy-velero
-  privileged: true
-  optional: true
-  dependsOn: [monitoring-agents]
-
-- name: hetzner-robotlb
-  releaseName: robotlb
-  optional: true
-  chart: cozy-hetzner-robotlb
-  namespace: cozy-hetzner-robotlb

packages/core/platform/images/cozystack-assets/Dockerfile

@@ -1,25 +0,0 @@
-FROM golang:1.25-alpine AS builder
-
-ARG TARGETOS
-ARG TARGETARCH
-
-RUN apk add --no-cache make git
-RUN apk add helm --repository=https://dl-cdn.alpinelinux.org/alpine/edge/community
-
-COPY . /src/
-WORKDIR /src
-
-RUN go mod download
-
-RUN go build -o /cozystack-assets-server -ldflags '-extldflags "-static" -w -s' ./cmd/cozystack-assets-server
-
-RUN make repos
-
-FROM alpine:3.22
-
-COPY --from=builder /src/_out/repos /cozystack/assets/repos
-COPY --from=builder /cozystack-assets-server /usr/bin/cozystack-assets-server
-COPY --from=builder /src/dashboards /cozystack/assets/dashboards
-
-WORKDIR /cozystack
-ENTRYPOINT ["/usr/bin/cozystack-assets-server"]

packages/core/platform/images/migrations/Dockerfile

@@ -0,0 +1,12 @@
+FROM alpine:3.22
+
+RUN wget -O- https://github.com/cozystack/cozyhr/raw/refs/heads/main/hack/install.sh | sh -s -- -v 1.5.0
+
+RUN apk add --no-cache kubectl helm coreutils git jq ca-certificates bash curl
+
+COPY migrations /migrations
+COPY run-migrations.sh /usr/bin/run-migrations.sh
+
+WORKDIR /migrations
+
+ENTRYPOINT ["/usr/bin/run-migrations.sh"]

packages/core/platform/images/migrations/run-migrations.sh

@@ -0,0 +1,41 @@
+#!/bin/sh
+set -euo pipefail
+
+NAMESPACE="${NAMESPACE:-cozy-system}"
+CURRENT_VERSION="${CURRENT_VERSION:-0}"
+TARGET_VERSION="${TARGET_VERSION:-0}"
+
+echo "Starting migrations from version $CURRENT_VERSION to $TARGET_VERSION"
+
+# Check if ConfigMap exists
+if ! kubectl get configmap --namespace "$NAMESPACE" cozystack-version >/dev/null 2>&1; then
+  echo "ConfigMap cozystack-version does not exist, creating it with version $TARGET_VERSION"
+  kubectl create configmap --namespace "$NAMESPACE" cozystack-version \
+    --from-literal=version="$TARGET_VERSION" \
+    --dry-run=client --output yaml | kubectl apply --filename -
+  echo "ConfigMap created with version $TARGET_VERSION"
+  exit 0
+fi
+
+# If current version is already at target, nothing to do
+if [ "$CURRENT_VERSION" -ge "$TARGET_VERSION" ]; then
+  echo "Current version $CURRENT_VERSION is already at or above target version $TARGET_VERSION"
+  exit 0
+fi
+
+# Run migrations sequentially from current version to target version
+for i in $(seq $((CURRENT_VERSION + 1)) $TARGET_VERSION); do
+  if [ -f "/migrations/$i" ]; then
+    echo "Running migration $i"
+    chmod +x /migrations/$i
+    /migrations/$i || {
+      echo "Migration $i failed"
+      exit 1
+    }
+    echo "Migration $i completed successfully"
+  else
+    echo "Migration $i not found, skipping"
+  fi
+done
+
+echo "All migrations completed successfully"

packages/core/platform/sources/backupstrategy-controller.yaml

@@ -0,0 +1,22 @@
+---
+apiVersion: cozystack.io/v1alpha1
+kind: PackageSource
+metadata:
+  name: cozystack.backupstrategy-controller
+spec:
+  sourceRef:
+    kind: OCIRepository
+    name: cozystack-packages
+    namespace: cozy-system
+    path: /
+  variants:
+  - name: default
+    dependsOn:
+    - cozystack.networking
+    components:
+    - name: backupstrategy-controller
+      path: system/backupstrategy-controller
+      install:
+        privileged: true
+        namespace: cozy-backupstrategy-controller
+        releaseName: backupstrategy-controller

packages/core/platform/sources/capi-provider-bootstrap-kubeadm.yaml

@@ -2,7 +2,7 @@
 apiVersion: cozystack.io/v1alpha1
 kind: PackageSource
 metadata:
-  name: cozystack.capi-providers-bootstrap
+  name: cozystack.capi-provider-bootstrap-kubeadm
 spec:
   sourceRef:
     kind: OCIRepository
@@ -10,6 +10,17 @@ spec:
     namespace: cozy-system
     path: /
   variants:
+  - name: default
+    dependsOn:
+    - cozystack.networking
+    - cozystack.capi-operator
+    components:
+    - name: capi-providers-bootstrap
+      path: system/capi-providers-bootstrap
+      install:
+        privileged: true
+        namespace: cozy-cluster-api
+        releaseName: capi-providers-bootstrap
   - name: kubevirt
     dependsOn:
     - cozystack.networking

packages/core/platform/sources/capi-provider-core.yaml

@@ -2,7 +2,7 @@
 apiVersion: cozystack.io/v1alpha1
 kind: PackageSource
 metadata:
-  name: cozystack.capi-providers-core
+  name: cozystack.capi-provider-core
 spec:
   sourceRef:
     kind: OCIRepository

packages/core/platform/sources/capi-provider-cp-kamaji.yaml

@@ -2,7 +2,7 @@
 apiVersion: cozystack.io/v1alpha1
 kind: PackageSource
 metadata:
-  name: cozystack.capi-providers-cpprovider
+  name: cozystack.capi-provider-cp-kamaji
 spec:
   sourceRef:
     kind: OCIRepository
@@ -10,6 +10,18 @@ spec:
     namespace: cozy-system
     path: /
   variants:
+  - name: default
+    dependsOn:
+    - cozystack.networking
+    - cozystack.capi-operator
+    - cozystack.kamaji
+    components:
+    - name: capi-providers-cpprovider
+      path: system/capi-providers-cpprovider
+      install:
+        privileged: true
+        namespace: cozy-cluster-api
+        releaseName: capi-providers-cpprovider
   - name: kamaji
     dependsOn:
     - cozystack.networking

packages/core/platform/sources/capi-provider-infra-kubevirt.yaml

@@ -2,7 +2,7 @@
 apiVersion: cozystack.io/v1alpha1
 kind: PackageSource
 metadata:
-  name: cozystack.capi-providers-infraprovider
+  name: cozystack.capi-provider-infra-kubevirt
 spec:
   sourceRef:
     kind: OCIRepository
@@ -10,6 +10,18 @@ spec:
     namespace: cozy-system
     path: /
   variants:
+  - name: default
+    dependsOn:
+    - cozystack.networking
+    - cozystack.capi-operator
+    - cozystack.kubevirt
+    components:
+    - name: capi-providers-infraprovider
+      path: system/capi-providers-infraprovider
+      install:
+        privileged: true
+        namespace: cozy-cluster-api
+        releaseName: capi-providers-infraprovider
   - name: kubevirt
     dependsOn:
     - cozystack.networking

packages/core/platform/sources/cozystack-engine.yaml

@@ -58,6 +58,7 @@ spec:
     dependsOn:
     - cozystack.networking
     - cozystack.keycloak
+    - cozystack.keycloak-operator
     libraries:
     - name: cozy-lib
       path: library/cozy-lib

packages/core/platform/sources/ingress-nginx.yaml

@@ -0,0 +1,22 @@
+---
+apiVersion: cozystack.io/v1alpha1
+kind: PackageSource
+metadata:
+  name: cozystack.ingress-nginx
+spec:
+  sourceRef:
+    kind: OCIRepository
+    name: cozystack-packages
+    namespace: cozy-system
+    path: /
+  variants:
+  - name: default
+    dependsOn:
+    - cozystack.networking
+    - cozystack.prometheus-operator-crds
+    components:
+    - name: ingress-nginx
+      path: system/ingress-nginx
+      install:
+        namespace: cozy-ingress-nginx
+        releaseName: ingress-nginx

packages/core/platform/sources/keycloak.yaml

@@ -14,9 +14,13 @@ spec:
     dependsOn:
     - cozystack.networking
     - cozystack.postgres-operator
+    libraries:
+    - name: cozy-lib
+      path: library/cozy-lib
     components:
     - name: keycloak
       path: system/keycloak
+      libraries: ["cozy-lib"]
       install:
         namespace: cozy-keycloak
         releaseName: keycloak

packages/core/platform/sources/kubernetes-application.yaml

@@ -14,10 +14,10 @@ spec:
       dependsOn:
         - cozystack.networking
         - cozystack.capi-operator
-        - cozystack.capi-providers-bootstrap
-        - cozystack.capi-providers-core
-        - cozystack.capi-providers-cpprovider
-        - cozystack.capi-providers-infraprovider
+        - cozystack.capi-provider-bootstrap-kubeadm
+        - cozystack.capi-provider-core
+        - cozystack.capi-provider-cp-kamaji
+        - cozystack.capi-provider-infra-kubevirt
       libraries:
         - name: cozy-lib
           path: library/cozy-lib

packages/core/platform/sources/metrics-server.yaml

@@ -0,0 +1,22 @@
+---
+apiVersion: cozystack.io/v1alpha1
+kind: PackageSource
+metadata:
+  name: cozystack.metrics-server
+spec:
+  sourceRef:
+    kind: OCIRepository
+    name: cozystack-packages
+    namespace: cozy-system
+    path: /
+  variants:
+  - name: default
+    dependsOn:
+    - cozystack.networking
+    - cozystack.prometheus-operator-crds
+    components:
+    - name: metrics-server
+      path: system/metrics-server
+      install:
+        namespace: cozy-metrics-server
+        releaseName: metrics-server

packages/core/platform/sources/monitoring-application.yaml

@@ -13,6 +13,7 @@ spec:
     - name: default
       dependsOn:
         - cozystack.networking
+        - cozystack.postgres-operator
       libraries:
         - name: cozy-lib
           path: library/cozy-lib

packages/core/platform/sources/postgres-application.yaml

@@ -13,6 +13,7 @@ spec:
     - name: default
       dependsOn:
         - cozystack.networking
+        - cozystack.postgres-operator
       libraries:
         - name: cozy-lib
           path: library/cozy-lib

packages/core/platform/templates/_helpers.tpl

@@ -1,108 +1,52 @@
-{{/*
-Get IP-addresses of master nodes
-*/}}
-{{- define "cozystack.master-node-ips" -}}
-{{- $nodes := lookup "v1" "Node" "" "" -}}
-{{- $ips := list -}}
-{{- range $node := $nodes.items -}}
-  {{- if eq (index $node.metadata.labels "node-role.kubernetes.io/control-plane") "" -}}
-    {{- range $address := $node.status.addresses -}}
-      {{- if eq $address.type "InternalIP" -}}
-        {{- $ips = append $ips $address.address -}}
-        {{- break -}}
-      {{- end -}}
-    {{- end -}}
-  {{- end -}}
+{{- define "cozystack.platform.package" -}}
+{{- $name := index . 0 -}}
+{{- $variant := default "default" (index . 1) -}}
+{{- $root := default $ (index . 2) -}}
+{{- $components := dict -}}
+{{- if gt (len .) 3 -}}
+{{- $components = index . 3 -}}
+{{- end -}}
+{{- $disabled := default (list) $root.Values.bundles.disabledPackages -}}
+{{- if not (has $name $disabled) -}}
+---
+apiVersion: cozystack.io/v1alpha1
+kind: Package
+metadata:
+  name: {{ $name }}
+spec:
+  variant: {{ $variant }}
+{{- if $components }}
+  components:
+{{ toYaml $components | indent 4 }}
+{{- end }}
 {{- end -}}
-{{ join "," $ips }}
 {{- end -}}
 
-{{/*
-Get Kubernetes API Endpoint from cozystack deployment
-Returns host:port format
-*/}}
-{{- define "cozystack.kubernetesAPIEndpoint" -}}
-{{- $cozyDeployment := lookup "apps/v1" "Deployment" "cozy-system" "cozystack" }}
-{{- $cozyContainers := dig "spec" "template" "spec" "containers" list $cozyDeployment }}
-{{- $kubernetesServiceHost := "" }}
-{{- $kubernetesServicePort := "" }}
-{{- range $cozyContainers }}
-{{- if eq .name "cozystack" }}
-{{- range .env }}
-{{- if eq .name "KUBERNETES_SERVICE_HOST" }}
-{{- $kubernetesServiceHost = .value }}
-{{- end }}
-{{- if eq .name "KUBERNETES_SERVICE_PORT" }}
-{{- $kubernetesServicePort = .value }}
-{{- end }}
-{{- end }}
-{{- end }}
-{{- end }}
-{{- if eq $kubernetesServiceHost "" }}
-{{- $kubernetesServiceHost = "kubernetes.default.svc" }}
-{{- end }}
-{{- if eq $kubernetesServicePort "" }}
-{{- $kubernetesServicePort = "443" }}
-{{- end }}
-{{- printf "%s:%s" $kubernetesServiceHost $kubernetesServicePort }}
+{{- define "cozystack.platform.package.default" -}}
+{{- $name := index . 0 -}}
+{{- $root := index . 1 -}}
+{{- include "cozystack.platform.package" (list $name "default" $root) }}
 {{- end -}}
 
-{{- define "cozystack.defaultDashboardValues" -}}
-kubeapps:
-{{- if .Capabilities.APIVersions.Has "source.toolkit.fluxcd.io/v1" }}
-{{- with (lookup "source.toolkit.fluxcd.io/v1" "HelmRepository" "cozy-public" "").items }}
-  redis:
-    master:
-      podAnnotations:
-        {{- range $index, $repo := . }}
-        {{- with (($repo.status).artifact).revision }}
-        repository.cozystack.io/{{ $repo.metadata.name }}: {{ quote . }}
-        {{- end }}
-        {{- end }}
-{{- end }}
-{{- end }}
-  frontend:
-    resourcesPreset: "none"
-  dashboard:
-    resourcesPreset: "none"
-    {{- $cozystackBranding:= lookup "v1" "ConfigMap" "cozy-system" "cozystack-branding" }}
-    {{- $branding := dig "data" "branding" "" $cozystackBranding }}
-    {{- if $branding }}
-    customLocale:
-      "Kubeapps": {{ $branding }}
-    {{- end }}
-    customStyle: |
-      {{- $logoImage := dig "data" "logo" "" $cozystackBranding }}
-      {{- if $logoImage }}
-      .kubeapps-logo {
-        background-image: {{ $logoImage }}
-      }
-      {{- end }}
-      #serviceaccount-selector {
-        display: none;
-      }
-      .login-moreinfo {
-        display: none;
-      }
-      a[href="#/docs"] {
-        display: none;
-      }
-      .login-group .clr-form-control .clr-control-label {
-        display: none;
-      }
-      .appview-separator div.appview-first-row div.center {
-        display: none;
-      }
-      .appview-separator div.appview-first-row section[aria-labelledby="app-secrets"] {
-        display: none;
-      }
-      .appview-first-row section[aria-labelledby="access-urls-title"] {
-        width: 100%;
-      }
-      .header-version {
-        display: none;
-      }
-      .label.label-info-secondary {
-        display: none;
-      }
-{{- end }}
+{{- define "cozystack.platform.package.optional" -}}
+{{- $name := index . 0 -}}
+{{- $variant := default "default" (index . 1) -}}
+{{- $root := default $ (index . 2) -}}
+{{- $disabled := default (list) $root.Values.bundles.disabledPackages -}}
+{{- $enabled := default (list) $root.Values.bundles.enabledPackages -}}
+{{- if and (has $name $enabled) (not (has $name $disabled)) -}}
+---
+apiVersion: cozystack.io/v1alpha1
+kind: Package
+metadata:
+  name: {{ $name }}
+spec:
+  variant: {{ $variant }}
+{{- end -}}
+{{- end -}}
+
+{{- define "cozystack.platform.package.optional.default" -}}
+{{- $name := index . 0 -}}
+{{- $root := index . 1 -}}
+{{- include "cozystack.platform.package.optional" (list $name "default" $root) }}
+{{- end -}}

packages/core/platform/templates/apps.yaml

@@ -1,118 +1,35 @@
-{{- $cozyConfig := lookup "v1" "ConfigMap" "cozy-system" "cozystack" }}
-{{- $cozystackBranding := lookup "v1" "ConfigMap" "cozy-system" "cozystack-branding" }}
-{{- $cozystackScheduling := lookup "v1" "ConfigMap" "cozy-system" "cozystack-scheduling" }}
 {{- $kubeRootCa := lookup "v1" "ConfigMap" "kube-system" "kube-root-ca.crt" }}
-{{- $bundleName := index $cozyConfig.data "bundle-name" }}
+{{- $bundleName := .Values.bundles.system.variant }}
 {{- $bundle := tpl (.Files.Get (printf "bundles/%s.yaml" $bundleName)) . | fromYaml }}
-{{/* Default values for _cluster config to ensure all required keys exist */}}
-{{- $clusterDefaults := dict
-    "root-host" ""
-    "bundle-name" ""
-    "clusterissuer" "http01"
-    "oidc-enabled" "false"
-    "expose-services" ""
-    "expose-ingress" "tenant-root"
-    "expose-external-ips" ""
-    "cluster-domain" "cozy.local"
-    "api-server-endpoint" ""
-}}
-{{- $clusterConfig := mergeOverwrite $clusterDefaults ($cozyConfig.data | default dict) }}
-{{- $host := "example.org" }}
-{{- $host := "example.org" }}
-{{- if $cozyConfig.data }}
-  {{- if hasKey $cozyConfig.data "root-host" }}
-    {{- $host = index $cozyConfig.data "root-host" }}
-  {{- end }}
-{{- end }}
-{{- $tenantRoot := dict }}
-{{- if .Capabilities.APIVersions.Has "helm.toolkit.fluxcd.io/v2" }}
-{{- $tenantRoot = lookup "helm.toolkit.fluxcd.io/v2" "HelmRelease" "tenant-root" "tenant-root" }}
-{{- end }}
-{{- if and $tenantRoot $tenantRoot.spec $tenantRoot.spec.values $tenantRoot.spec.values.host }}
-{{- $host = $tenantRoot.spec.values.host }}
-{{- else }}
-{{- end }}
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  annotations:
-    helm.sh/resource-policy: keep
-  labels:
-    tenant.cozystack.io/tenant-root: ""
-    namespace.cozystack.io/etcd: tenant-root
-    namespace.cozystack.io/monitoring: tenant-root
-    namespace.cozystack.io/ingress: tenant-root
-    namespace.cozystack.io/seaweedfs: tenant-root
-    namespace.cozystack.io/host: "{{ $host }}"
-  name: tenant-root
 ---
 apiVersion: v1
 kind: Secret
 metadata:
   name: cozystack-values
-  namespace: tenant-root
+  namespace: cozy-system
   labels:
     reconcile.fluxcd.io/watch: Enabled
 type: Opaque
 stringData:
   values.yaml: |
     _cluster:
-      {{- $clusterConfig | toYaml | nindent 6 }}
-      {{- with $cozystackBranding.data }}
+      root-host: {{ .Values.publishing.host | quote }}
+      bundle-name: {{ .Values.bundles.system.variant | quote }}
+      clusterissuer: {{ .Values.publishing.certificates.issuerType | quote }}
+      oidc-enabled: {{ .Values.authentication.oidc.enabled | quote }}
+      expose-services: {{ .Values.publishing.exposedServices | join "," | quote }}
+      expose-ingress: {{ .Values.publishing.ingressName | quote }}
+      expose-external-ips: {{ .Values.publishing.externalIPs | join "," | quote }}
+      cluster-domain: {{ .Values.networking.clusterDomain | quote }}
+      api-server-endpoint: {{ .Values.publishing.apiServerEndpoint | quote }}
+      {{- with .Values.branding }}
       branding:
         {{- . | toYaml | nindent 8 }}
       {{- end }}
-      {{- with $cozystackScheduling.data }}
+      {{- with .Values.scheduling }}
       scheduling:
         {{- . | toYaml | nindent 8 }}
       {{- end }}
       {{- with $kubeRootCa.data }}
       kube-root-ca: {{ index . "ca.crt" | b64enc | quote }}
       {{- end }}
-    _namespace:
-      etcd: tenant-root
-      monitoring: tenant-root
-      ingress: tenant-root
-      seaweedfs: tenant-root
-      host: {{ $host | quote }}
----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: tenant-root
-  namespace: tenant-root
-  labels:
-    cozystack.io/ui: "true"
-    apps.cozystack.io/application.kind: Tenant
-    apps.cozystack.io/application.group: apps.cozystack.io
-    apps.cozystack.io/application.name: tenant-root
-spec:
-  interval: 0s
-  releaseName: tenant-root
-  install:
-    remediation:
-      retries: -1
-  upgrade:
-    remediation:
-      retries: -1
-  chart:
-    spec:
-      chart: tenant
-      version: '>= 0.0.0-0'
-      sourceRef:
-        kind: HelmRepository
-        name: cozystack-apps
-        namespace: cozy-public
-  valuesFrom:
-    - kind: Secret
-      name: cozystack-values
-  values:
-    host: "{{ $host }}"
-  dependsOn:
-  {{- range $x := $bundle.releases }}
-  {{- if has $x.name (list "cilium" "kubeovn") }}
-  - name: {{ $x.name }}
-    namespace: {{ $x.namespace }}
-  {{- end }}
-  {{- end }}

packages/core/platform/templates/bundles/iaas.yaml

@@ -0,0 +1,20 @@
+{{- if and .Values.bundles.iaas.enabled (ne .Values.bundles.system.variant "isp-full") }}
+{{- fail "bundles.iaas.enabled can only be true when bundles.system.variant is 'isp-full'" }}
+{{- end }}
+{{- if and .Values.bundles.iaas.enabled (eq .Values.bundles.system.variant "isp-full") }}
+{{include "cozystack.platform.package.default" (list "cozystack.kubevirt" $) }}
+{{include "cozystack.platform.package.default" (list "cozystack.kubevirt-cdi" $) }}
+{{include "cozystack.platform.package.optional.default" (list "cozystack.gpu-operator" $) }}
+{{include "cozystack.platform.package.default" (list "cozystack.kamaji" $) }}
+{{include "cozystack.platform.package.default" (list "cozystack.capi-operator" $) }}
+{{include "cozystack.platform.package.default" (list "cozystack.capi-provider-bootstrap-kubeadm" $) }}
+{{include "cozystack.platform.package.default" (list "cozystack.capi-provider-core" $) }}
+{{include "cozystack.platform.package.default" (list "cozystack.capi-provider-cp-kamaji" $) }}
+{{include "cozystack.platform.package.default" (list "cozystack.capi-provider-infra-kubevirt" $) }}
+{{include "cozystack.platform.package.default" (list "cozystack.bucket-application" $) }}
+{{include "cozystack.platform.package" (list "cozystack.kubernetes-application" "kubevirt" $) }}
+{{include "cozystack.platform.package" (list "cozystack.virtual-machine-application" "kubevirt" $) }}
+{{include "cozystack.platform.package" (list "cozystack.virtualprivatecloud-application" "kubevirt" $) }}
+{{include "cozystack.platform.package" (list "cozystack.vm-disk-application" "kubevirt" $) }}
+{{include "cozystack.platform.package" (list "cozystack.vm-instance-application" "kubevirt" $) }}
+{{- end }}

packages/core/platform/templates/bundles/naas.yaml

@@ -0,0 +1,8 @@
+{{- if and .Values.bundles.naas.enabled (not (or (eq .Values.bundles.system.variant "isp-full") (eq .Values.bundles.system.variant "isp-hosted"))) }}
+{{- fail "bundles.naas.enabled can only be true when bundles.system.variant is 'isp-full' or 'isp-hosted'" }}
+{{- end }}
+{{- if and .Values.bundles.naas.enabled (or (eq .Values.bundles.system.variant "isp-full") (eq .Values.bundles.system.variant "isp-hosted")) }}
+{{include "cozystack.platform.package.default" (list "cozystack.http-cache-application" $) }}
+{{include "cozystack.platform.package.default" (list "cozystack.tcp-balancer-application" $) }}
+{{include "cozystack.platform.package.default" (list "cozystack.vpn-application" $) }}
+{{- end }}

packages/core/platform/templates/bundles/paas.yaml

@@ -0,0 +1,20 @@
+{{- if and .Values.bundles.paas.enabled (not (or (eq .Values.bundles.system.variant "isp-full") (eq .Values.bundles.system.variant "isp-hosted"))) }}
+{{- fail "bundles.paas.enabled can only be true when bundles.system.variant is 'isp-full' or 'isp-hosted'" }}
+{{- end }}
+{{- if and .Values.bundles.paas.enabled (or (eq .Values.bundles.system.variant "isp-full") (eq .Values.bundles.system.variant "isp-hosted")) }}
+{{include "cozystack.platform.package.default" (list "cozystack.mariadb-operator" $) }}
+{{include "cozystack.platform.package.default" (list "cozystack.kafka-operator" $) }}
+{{include "cozystack.platform.package.default" (list "cozystack.clickhouse-operator" $) }}
+{{include "cozystack.platform.package.default" (list "cozystack.foundationdb-operator" $) }}
+{{include "cozystack.platform.package.default" (list "cozystack.rabbitmq-operator" $) }}
+{{include "cozystack.platform.package.default" (list "cozystack.redis-operator" $) }}
+{{include "cozystack.platform.package.default" (list "cozystack.clickhouse-application" $) }}
+{{include "cozystack.platform.package.default" (list "cozystack.ferretdb-application" $) }}
+{{include "cozystack.platform.package.default" (list "cozystack.foundationdb-application" $) }}
+{{include "cozystack.platform.package.default" (list "cozystack.kafka-application" $) }}
+{{include "cozystack.platform.package.default" (list "cozystack.mysql-application" $) }}
+{{include "cozystack.platform.package.default" (list "cozystack.nats-application" $) }}
+{{include "cozystack.platform.package.default" (list "cozystack.postgres-application" $) }}
+{{include "cozystack.platform.package.default" (list "cozystack.rabbitmq-application" $) }}
+{{include "cozystack.platform.package.default" (list "cozystack.redis-application" $) }}
+{{- end }}

packages/core/platform/templates/bundles/system.yaml

@@ -0,0 +1,72 @@
+{{- if .Values.bundles.system.enabled }}
+
+# Networking
+{{- if eq .Values.bundles.system.variant "isp-full" }}
+{{- $networkingComponents := dict -}}
+{{- if .Values.networking -}}
+{{- $kubeovnValues := dict "kube-ovn" (dict
+  "ipv4" (dict
+    "POD_CIDR" .Values.networking.podCIDR
+    "POD_GATEWAY" .Values.networking.podGateway
+    "SVC_CIDR" .Values.networking.serviceCIDR
+    "JOIN_CIDR" .Values.networking.joinCIDR)) -}}
+{{- $_ := set $networkingComponents "kubeovn" (dict "values" $kubeovnValues) -}}
+{{- end -}}
+{{include "cozystack.platform.package" (list "cozystack.networking" "kubeovn-cilium" $ $networkingComponents) }}
+{{include "cozystack.platform.package.default" (list "cozystack.kubeovn-webhook" $) }}
+{{include "cozystack.platform.package.default" (list "cozystack.kubeovn-plunger" $) }}
+{{include "cozystack.platform.package.default" (list "cozystack.cozy-proxy" $) }}
+{{include "cozystack.platform.package.default" (list "cozystack.multus" $) }}
+{{include "cozystack.platform.package.default" (list "cozystack.metallb" $) }}
+{{include "cozystack.platform.package.default" (list "cozystack.reloader" $) }}
+{{include "cozystack.platform.package.default" (list "cozystack.linstor" $) }}
+{{include "cozystack.platform.package.default" (list "cozystack.snapshot-controller" $) }}
+{{- end }}
+
+{{- if eq .Values.bundles.system.variant "isp-hosted" }}
+{{include "cozystack.platform.package" (list "cozystack.networking" "noop" $) }}
+{{- end }}
+
+# Cozystack Engine
+{{- if .Values.authentication.oidc.enabled }}
+{{include "cozystack.platform.package" (list "cozystack.cozystack-engine" "oidc" $) }}
+{{include "cozystack.platform.package.default" (list "cozystack.keycloak" $) }}
+{{include "cozystack.platform.package.default" (list "cozystack.keycloak-operator" $) }}
+{{- else }}
+{{include "cozystack.platform.package" (list "cozystack.cozystack-engine" "default" $) }}
+{{- end }}
+
+# Common Packages
+{{include "cozystack.platform.package.default" (list "cozystack.cert-manager" $) }}
+{{include "cozystack.platform.package.default" (list "cozystack.victoria-metrics-operator" $) }}
+{{- $tenantComponents := dict -}}
+{{- $tenantClusterValues := dict "_cluster" (dict "oidc-enabled" (ternary "true" "false" .Values.authentication.oidc.enabled)) -}}
+{{- $_ := set $tenantComponents "tenant" (dict "values" $tenantClusterValues) }}
+{{include "cozystack.platform.package" (list "cozystack.tenant-application" "default" $ $tenantComponents) }}
+{{include "cozystack.platform.package.default" (list "cozystack.ingress-application" $) }}
+{{include "cozystack.platform.package.default" (list "cozystack.seaweedfs-application" $) }}
+{{include "cozystack.platform.package.default" (list "cozystack.info-application" $) }}
+{{include "cozystack.platform.package.default" (list "cozystack.monitoring-application" $) }}
+{{include "cozystack.platform.package.default" (list "cozystack.etcd-application" $) }}
+{{include "cozystack.platform.package.default" (list "cozystack.cozystack-basics" $) }}
+{{include "cozystack.platform.package.optional.default" (list "cozystack.backupstrategy-controller" $) }}
+{{include "cozystack.platform.package.default" (list "cozystack.backup-controller" $) }}
+{{include "cozystack.platform.package.optional.default" (list "cozystack.velero" $) }}
+{{include "cozystack.platform.package.default" (list "cozystack.vertical-pod-autoscaler" $) }}
+{{include "cozystack.platform.package.default" (list "cozystack.monitoring-agents" $) }}
+{{include "cozystack.platform.package.default" (list "cozystack.goldpinger" $) }}
+{{include "cozystack.platform.package.default" (list "cozystack.prometheus-operator-crds" $) }}
+{{include "cozystack.platform.package.default" (list "cozystack.grafana-operator" $) }}
+{{include "cozystack.platform.package.default" (list "cozystack.etcd-operator" $) }}
+{{include "cozystack.platform.package.default" (list "cozystack.postgres-operator" $) }}
+{{include "cozystack.platform.package.default" (list "cozystack.objectstorage-controller" $) }}
+
+# Optional System Packages (controlled via bundles.enabledPackages)
+{{include "cozystack.platform.package.optional.default" (list "cozystack.nfs-driver" $) }}
+{{include "cozystack.platform.package.optional.default" (list "cozystack.telepresence" $) }}
+{{include "cozystack.platform.package.optional.default" (list "cozystack.external-dns" $) }}
+{{include "cozystack.platform.package.optional.default" (list "cozystack.external-secrets-operator" $) }}
+{{include "cozystack.platform.package.optional.default" (list "cozystack.bootbox" $) }}
+{{include "cozystack.platform.package.optional.default" (list "cozystack.hetzner-robotlb" $) }}
+
+{{- end }}

packages/core/platform/templates/containerd-registry-secret.yaml

@@ -0,0 +1,35 @@
+{{- if .Values.registries.mirrors }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: patch-containerd
+  namespace: cozy-system
+type: Opaque
+stringData:
+{{- range $registry, $mirror := .Values.registries.mirrors }}
+{{- if $mirror.endpoints }}
+  {{ $registry }}.toml: |
+    server = "https://{{ $registry }}"
+{{- range $endpoint := $mirror.endpoints }}
+    [host."{{ $endpoint }}"]
+      capabilities = ["pull", "resolve"]
+{{- $endpointConfig := index $.Values.registries.config $endpoint }}
+{{- if $endpointConfig }}
+{{- if $endpointConfig.tls }}
+{{- if $endpointConfig.tls.insecureSkipVerify }}
+      skip_verify = true
+{{- end }}
+{{- end }}
+{{- if $endpointConfig.auth }}
+      [host."{{ $endpoint }}".auth]
+        username = "{{ $endpointConfig.auth.username }}"
+        password = "{{ $endpointConfig.auth.password }}"
+{{- end }}
+{{- else }}
+      skip_verify = true
+{{- end }}
+{{- end }}
+{{- end }}
+{{- end }}
+{{- end }}
+

packages/core/platform/templates/cozystack-assets.yaml

@@ -1,73 +0,0 @@
-apiVersion: apps/v1
-kind: StatefulSet
-metadata:
-  name: cozystack-assets
-  namespace: cozy-system
-  labels:
-    app: cozystack-assets
-spec:
-  serviceName: cozystack-assets
-  replicas: 1
-  selector:
-    matchLabels:
-      app: cozystack-assets
-  template:
-    metadata:
-      labels:
-        app: cozystack-assets
-    spec:
-      hostNetwork: true
-      containers:
-      - name: assets-server
-        image: "{{ .Values.assets.image }}"
-        args:
-        - "-dir=/cozystack/assets"
-        - "-address=:8123"
-        ports:
-        - name: http
-          containerPort: 8123
-          hostPort: 8123
-      tolerations:
-      - operator: Exists
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: cozystack-assets-reader
-  namespace: cozy-system
-rules:
-  - apiGroups: [""]
-    resources:
-      - pods/proxy
-    resourceNames:
-      - cozystack-assets-0
-    verbs:
-      - get
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: cozystack-assets-reader
-  namespace: cozy-system
-subjects:
-  - kind: User
-    name: cozystack-assets-reader
-    apiGroup: rbac.authorization.k8s.io
-roleRef:
-  kind: Role
-  name: cozystack-assets-reader
-  apiGroup: rbac.authorization.k8s.io
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: cozystack-assets
-  namespace: cozy-system
-spec:
-  ports:
-  - name: http
-    port: 80
-    targetPort: 8123
-  selector:
-    app: cozystack-assets
-  type: ClusterIP