This PR prepares the release `v0.38.2`.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated container image versions from v0.38.1 to v0.38.2 across system
packages with corresponding digest updates. All image references have
been bumped to the latest version with new SHA256 hashes.
<sub>✏️ Tip: You can customize this high-level summary in your review
settings.</sub>
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Problem
This PR reverts the changes introduced in #1630 that caused a regression
affecting namespace deletion and upgrades from previous versions,
particularly when running migration 20.
### Symptoms
Users are experiencing issues with namespace deletion and upgrades. The
namespace controller reports:
```
NamespaceDeletionContentFailure: True
ContentDeletionFailed: Failed to delete all resource types, 25 remaining:
content is not a list: []unstructured.Unstructured
```
The error indicates that Kubernetes API server expects a proper list
type, but receives `[]unstructured.Unstructured` instead, which breaks
namespace finalization.
### Root Cause
The changes in #1630 modified how dynamic list kinds are represented,
switching from `unstructured.UnstructuredList` to typed
`ApplicationList`. While this was intended to fix kind representation
issues, it introduced a compatibility problem:
1. The namespace deletion controller expects resources to implement the
standard Kubernetes list interface
2. The typed lists may not be properly recognized during namespace
finalization
3. This breaks upgrades from previous versions where resources were
stored as unstructured
### Solution
This PR reverts the problematic changes to restore compatibility with
namespace deletion and upgrade scenarios. We are planning a more
comprehensive fix that will address both the original kind
representation issue and namespace deletion compatibility.
### Related Issues
- Fixes namespace deletion failures
- Fixes upgrade issues from previous versions (migration 20)
- Reverts regression introduced in #1630
### Next Steps
A more comprehensive fix is being prepared that will:
- Properly handle kind representation for dynamic types
- Ensure compatibility with namespace deletion controller
- Support upgrades from previous versions
**Chores**
* Updated SeaweedFS Helm chart templates with configurable certificate
duration and renewal settings.
<!-- Thank you for making a contribution! Here are some tips for you:
- Start the PR title with the [label] of Cozystack component:
- For system components: [platform], [system], [linstor], [cilium],
[kube-ovn], [dashboard], [cluster-api], etc.
- For managed apps: [apps], [tenant], [kubernetes], [postgres],
[virtual-machine] etc.
- For development and maintenance: [tests], [ci], [docs], [maintenance].
- If it's a work in progress, consider creating this PR as a draft.
- Don't hesistate to ask for opinion and review in the community chats,
even if it's still a draft.
- Add the label `backport` if it's a bugfix that needs to be backported
to a previous version.
-->
## What this PR does
### Release note
<!-- Write a release note:
- Explain what has changed internally and for users.
- Start with the same [label] as in the PR title
- Follow the guidelines at
https://github.com/kubernetes/community/blob/master/contributors/guide/release-notes.md.
-->
```release-note
- Extended CA certificate duration to reduce disruptive CA rotations.
- Added mechanism to sync SeaweedFS client certificates across clusters.
- Enhanced certificate management to ensure Hikube provisioner always receives up-to-date client certificates.
```
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Enhanced CA certificate configuration for SeaweedFS by extending the
validity duration and adjusting the renewal window to improve long-term
certificate management and system stability.
<sub>✏️ Tip: You can customize this high-level summary in your review
settings.</sub>
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
<!-- Thank you for making a contribution! Here are some tips for you:
- Start the PR title with the [label] of Cozystack component:
- For system components: [platform], [system], [linstor], [cilium],
[kube-ovn], [dashboard], [cluster-api], etc.
- For managed apps: [apps], [tenant], [kubernetes], [postgres],
[virtual-machine] etc.
- For development and maintenance: [tests], [ci], [docs], [maintenance].
- If it's a work in progress, consider creating this PR as a draft.
- Don't hesistate to ask for opinion and review in the community chats,
even if it's still a draft.
- Add the label `backport` if it's a bugfix that needs to be backported
to a previous version.
-->
## What this PR does
### Release note
<!-- Write a release note:
- Explain what has changed internally and for users.
- Start with the same [label] as in the PR title
- Follow the guidelines at
https://github.com/kubernetes/community/blob/master/contributors/guide/release-notes.md.
-->
```release-note
[tenant][kubernetes] Introduce better cleanup logic
```
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added an automated pre-delete cleanup job for tenant namespaces to
remove tenant-related releases during uninstall.
* **Improvements**
* Cleanup now runs early in the uninstall sequence with a clearer,
stepwise orchestration for resource removal.
* Expanded permissions and execution allowances to enable the cleanup
workflow.
* Deployment annotations now use a content checksum to better detect
config changes.
* **Removals**
* Previous teardown sequence for certain release types was removed and
replaced by the new workflow.
<sub>✏️ Tip: You can customize this high-level summary in your review
settings.</sub>
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## What this PR does
This PR adds config hash annotations to the dashboard deployment
templates to ensure pods are automatically restarted when their
configuration changes.
Changes:
- Added `checksum/config` annotation to `nginx.yaml` deployment that
computes a hash of `nginx-config.yaml`
- Added `checksum/config` annotation to `web.yaml` deployment that
computes a hash of `configmap.yaml`
This replaces the hardcoded checksum in nginx.yaml with a dynamically
computed one, and adds a new checksum for the web deployment.
### Release note
```release-note
[dashboard] Add config hash annotations to automatically restart pods when configuration changes
```
<!-- Thank you for making a contribution! Here are some tips for you:
- Start the PR title with the [label] of Cozystack component:
- For system components: [platform], [system], [linstor], [cilium],
[kube-ovn], [dashboard], [cluster-api], etc.
- For managed apps: [apps], [tenant], [kubernetes], [postgres],
[virtual-machine] etc.
- For development and maintenance: [tests], [ci], [docs], [maintenance].
- If it's a work in progress, consider creating this PR as a draft.
- Don't hesistate to ask for opinion and review in the community chats,
even if it's still a draft.
- Add the label `backport` if it's a bugfix that needs to be backported
to a previous version.
-->
## What this PR does
### Release note
<!-- Write a release note:
- Explain what has changed internally and for users.
- Start with the same [label] as in the PR title
- Follow the guidelines at
https://github.com/kubernetes/community/blob/master/contributors/guide/release-notes.md.
-->
```release-note
Add changelogs for v0.37.* and v0.38.0
```
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* VPC with Multus CNI, dashboard VNC, configurable worker versions,
dedicated lineage webhook daemonset, tenant workload listing
* **Bug Fixes**
* RBAC and namespace listing fixes (including non‑OIDC/system:masters),
dashboard logout, migration/readiness checks, load balancer cleanup,
various chart/config fixes
* **Security**
* Redis image update, stricter ingress HTTPS enforcement, flux operator
hardening
* **Documentation**
* Kubernetes troubleshooting, backup/recovery, migration guidance,
website and mobile updates
<sub>✏️ Tip: You can customize this high-level summary in your review
settings.</sub>
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Thank you for making a contribution! Here are some tips for you:
- Start the PR title with the [label] of Cozystack component:
- For system components: [platform], [system], [linstor], [cilium],
[kube-ovn], [dashboard], [cluster-api], etc.
- For managed apps: [apps], [tenant], [kubernetes], [postgres],
[virtual-machine] etc.
- For development and maintenance: [tests], [ci], [docs], [maintenance].
- If it's a work in progress, consider creating this PR as a draft.
- Don't hesistate to ask for opinion and review in the community chats,
even if it's still a draft.
- Add the label `backport` if it's a bugfix that needs to be backported
to a previous version.
-->
## What this PR does
### Release note
<!-- Write a release note:
- Explain what has changed internally and for users.
- Start with the same [label] as in the PR title
- Follow the guidelines at
https://github.com/kubernetes/community/blob/master/contributors/guide/release-notes.md.
-->
```release-note
Add AI-agent for changelogs generation
```
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Updated agent documentation to include changelog generation guidance
* Added comprehensive changelog generation guide with workflow
procedures and validation steps
* **Chores**
* New scripts added for optional repository management and release notes
publishing
* Project configuration updated to exclude additional directories
* Removed outdated changelog entry
<sub>✏️ Tip: You can customize this high-level summary in your review
settings.</sub>
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## What this PR does
This PR adds instructions for AI agents on how to handle comments from
AI bot reviewers (like Qodo, Copilot, etc.).
Changes:
- Added new section "Addressing AI Bot Reviewer Comments" to
`docs/agents/contributing.md`
- Instructions on how to get PR comments using `gh pr view --comments`
- Guidelines on evaluating each comment carefully (don't blindly apply
all suggestions)
- Clear criteria for when to apply and when to skip AI bot suggestions
- Emphasis on leaving changes uncommitted for user review
Key principles:
- Evaluate each suggestion based on context, project conventions, and
impact
- Apply legitimate fixes but skip over-engineering or style mismatches
- Leave changes uncommitted so the user can review and decide
### Release note
```release-note
[docs] Add instructions for AI agents on handling AI bot reviewer comments
```
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Added guidance for addressing AI bot reviewer comments in the
contributor guide.
* Introduced comprehensive changelog generation procedures.
* **Chores**
* Finalized v0.37.0 release.
* Enhanced release automation infrastructure with new tooling scripts
for repository checks and release note uploads.
* Updated project documentation index.
<sub>✏️ Tip: You can customize this high-level summary in your review
settings.</sub>
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## What this PR does
This PR adds AI agent documentation structure to help AI coding
assistants work more effectively with the Cozystack codebase.
Changes:
- Added `AGENTS.md` in the root with an overview and agent documentation
table
- Created `docs/agents/` directory with specialized agent instructions:
- `overview.md` - Project structure and conventions
- `contributing.md` - Git workflow, commits, and pull requests
- `releasing.md` - Release process (references `docs/release.md`)
- Organized documentation to make it easy for AI agents to find relevant
instructions
### Release note
```release-note
[docs] Add AI agent documentation structure with instructions for contributing, releasing, and project overview
```
This PR prepares the release `v0.38.0`.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Chores
* Updated image references and digests across multiple packages from
alpha prerelease versions to stable v0.38.0 releases, including updates
to kubevirt-csi-driver, cozystack-api, cozystack-controller, dashboard
components, kamaji, kubeovn modules, s3manager, and other system
packages.
<sub>✏️ Tip: You can customize this high-level summary in your review
settings.</sub>
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## What this PR does
Remove spaces while processing exposed-external-ips list in cozystack
configmap as they 1) are user-specified and 2) lead to an incorrect
resource being created from it.
### Release note
```release-note
Remove spaces while processing exposed-external-ips list in cozystack configmap
```
This patch breaks introduces a helper function in cozy-lib to correctly
handle special case resources when transforming a nested map of limits
and requests to a flat map suitable for use in resourceQuotas. As a
result, admins can now specify any types of resources as resource quotas
for tenants, and they will be correctly transformed to the correct
format for the underlying kubernetes ResourceQuota. In addition to the
previously supported compute resources, such as CPU, memory, and custom
resources, like GPUs, special quota strings such as
"services.loadbalancers" are now correctly handled.
```release-note
[cozy-lib,platform] Support resource quotas for special kubernetes
quotas, such as service.loadbalncer count and others.
```
<!-- Thank you for making a contribution! Here are some tips for you:
- Start the PR title with the [label] of Cozystack component:
- For system components: [platform], [system], [linstor], [cilium],
[kube-ovn], [dashboard], [cluster-api], etc.
- For managed apps: [apps], [tenant], [kubernetes], [postgres],
[virtual-machine] etc.
- For development and maintenance: [tests], [ci], [docs], [maintenance].
- If it's a work in progress, consider creating this PR as a draft.
- Don't hesistate to ask for opinion and review in the community chats,
even if it's still a draft.
- Add the label `backport` if it's a bugfix that needs to be backported
to a previous version.
-->
## What this PR does
### Release note
<!-- Write a release note:
- Explain what has changed internally and for users.
- Start with the same [label] as in the PR title
- Follow the guidelines at
https://github.com/kubernetes/community/blob/master/contributors/guide/release-notes.md.
-->
```release-note
[]
```
Update MariaDB operator to a new version.
```release-note
[ci,dx] Update MariaDB operator version
```
<!-- Thank you for making a contribution! Here are some tips for you:
- Start the PR title with the [label] of Cozystack component:
- For system components: [platform], [system], [linstor], [cilium],
[kube-ovn], [dashboard], [cluster-api], etc.
- For managed apps: [apps], [tenant], [kubernetes], [postgres],
[virtual-machine] etc.
- For development and maintenance: [tests], [ci], [docs], [maintenance].
- If it's a work in progress, consider creating this PR as a draft.
- Don't hesistate to ask for opinion and review in the community chats,
even if it's still a draft.
- Add the label `backport` if it's a bugfix that needs to be backported
to a previous version.
-->
## What this PR does
### Release note
<!-- Write a release note:
- Explain what has changed internally and for users.
- Start with the same [label] as in the PR title
- Follow the guidelines at
https://github.com/kubernetes/community/blob/master/contributors/guide/release-notes.md.
-->
```release-note
[]
```
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Support for external MariaDB instances and physical backups management
* Validation webhook added for physical backups
* New config option to specify MariaDB image registry/name
* **Updates**
* MariaDB operator bumped to 25.10.2
* Default MariaDB version updated from 11.4 to 11.8
* Expanded Kubernetes permissions for endpoint slices and volume
snapshots
* Pod metadata label added to MariaDB pods
* **Documentation**
* Updated docs links and version badges in charts README
<sub>✏️ Tip: You can customize this high-level summary in your review
settings.</sub>
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
This patch adds special handling for raw Kubernetes ResourceQuota
fields, such as `services.loadbalancers`, preventing them from being
wrapped as `limits.*` or `requests.*` keys by the flatten helper. This
ensures that LoadBalancer quotas render correctly in tenant
specifications.
```release-note
[cozy-lib] Correctly render services.loadbalancers in ResourceQuota without limits.* or requests.* prefixes.
```
<!-- Thank you for making a contribution! Here are some tips for you:
- Start the PR title with the [label] of Cozystack component:
- For system components: [platform], [system], [linstor], [cilium],
[kube-ovn], [dashboard], [cluster-api], etc.
- For managed apps: [apps], [tenant], [kubernetes], [postgres],
[virtual-machine] etc.
- For development and maintenance: [tests], [ci], [docs], [maintenance].
- If it's a work in progress, consider creating this PR as a draft.
- Don't hesistate to ask for opinion and review in the community chats,
even if it's still a draft.
- Add the label `backport` if it's a bugfix that needs to be backported
to a previous version.
-->
## What this PR does
### Release note
<!-- Write a release note:
- Explain what has changed internally and for users.
- Start with the same [label] as in the PR title
- Follow the guidelines at
https://github.com/kubernetes/community/blob/master/contributors/guide/release-notes.md.
-->
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Refactor**
* Resource flattening now handles compute and quota keys separately:
compute values are sanitized/flattened, quota-like inputs are emitted
directly as plain YAML.
* **Documentation**
* Added in-template comments and clarified examples for resource
processing behavior.
* **New Features**
* CI now runs unit tests; new test targets and test harnesses added
along with a test chart and test cases for quota handling.
<sub>✏️ Tip: You can customize this high-level summary in your review
settings.</sub>
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
<!-- Thank you for making a contribution! Here are some tips for you:
- Start the PR title with the [label] of Cozystack component:
- For system components: [platform], [system], [linstor], [cilium],
[kube-ovn], [dashboard], [cluster-api], etc.
- For managed apps: [apps], [tenant], [kubernetes], [postgres],
[virtual-machine] etc.
- For development and maintenance: [tests], [ci], [docs], [maintenance].
- If it's a work in progress, consider creating this PR as a draft.
- Don't hesistate to ask for opinion and review in the community chats,
even if it's still a draft.
- Add the label `backport` if it's a bugfix that needs to be backported
to a previous version.
-->
## What this PR does
This PR updates Piraeus Operator to enable RWX support released in
https://github.com/piraeusdatastore/piraeus-operator/releases/tag/v2.10.0
### Release note
<!-- Write a release note:
- Explain what has changed internally and for users.
- Start with the same [label] as in the PR title
- Follow the guidelines at
https://github.com/kubernetes/community/blob/master/contributors/guide/release-notes.md.
-->
```release-note
[linstor] Update Piraeus Operator to v2.10.1 to enable RWX support
```
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added NFS server component and affinity controller support for
enhanced storage configuration
* Expanded kubectl output with additional status columns for improved
cluster visibility
* Added support for pod labels, annotations, and security context
customization
* **Chores**
* Updated Helm chart to version 2.10.1
* Updated multiple component versions including CSI provisioner,
snapshotter, DRBD reactor, and other dependencies
* **Documentation**
* Updated README to reference external Helm-based deployment guidelines
<sub>✏️ Tip: You can customize this high-level summary in your review
settings.</sub>
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## What this PR does
The cozy-lib library package got complicated enough to warrant its own
unit tests. Since unit tests are a "good thing" (tm), a somewhat generic
framework for running all kinds of unit tests was introduced into the CI
pipeline and Makefile targets. For now all it runs is `make test`
against the `packages/{library,apps,system,extra}/*` directories,
wherever a `test` target is present in the Makefile, and for now this is
only for the `cozy-lib` Helm library chart.
### Release note
```release-note
[ci,dx] Introduce a scaffold for running unit tests locally and in CI
and add the first unit tests for the cozy-lib helper Helm chart.
```
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Tests**
* Integrated Helm chart unit tests into the CI/CD pipeline for automated
validation.
* Established test infrastructure for cozy-lib package with test cases
for quota configuration and resource validation.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
