[tenant] Create affinity class design draft

Signed-off-by: Kirill Ilin <stitch14@yandex.ru>

.coderabbit.yaml

@@ -1,5 +0,0 @@
-reviews:
-  auto_review:
-    enabled: true
-    auto_incremental_review: true
-    drafts: false

.gemini/config.yaml

@@ -1,23 +0,0 @@
-have_fun: false
-
-ignore_patterns:
-  - "**/charts/**"
-  - "**/vendor/**"
-  - "**/zz_generated.*.go"
-  - "**/pkg/generated/**"
-  - "**/_out/**"
-  - "**/*.tgz"
-  - "**/dashboards/**/*.json"
-  - "**/*.patch"
-  - "**/*.diff"
-  - "**/images/*.json"
-
-code_review:
-  disable: false
-  comment_severity_threshold: LOW
-  max_review_comments: 50
-  pull_request_opened:
-    help: false
-    summary: true
-    code_review: true
-    include_drafts: false

.gemini/styleguide.md

@@ -1,110 +0,0 @@
-# Cozystack Review Guidelines
-
-## Project Architecture
-
-Cozystack is a Kubernetes-based PaaS built on Helm umbrella charts and FluxCD.
-Packages live in `packages/{core,system,apps,extra,library,tests}/`. The `library/` group holds reusable helper charts; the `tests/` group exists because library charts are not directly testable.
-Each package wraps one or more upstream Helm charts.
-Go code in `cmd/`, `internal/`, `pkg/` implements Kubernetes controllers and API server.
-Static CRDs are generated by `hack/update-codegen.sh` from types under `api/v1alpha1/`, `api/backups/`, and `api/dashboard/`.
-App Kinds (like `Postgres`, `Kafka`) live in `api/apps/v1alpha1/` but are registered dynamically at runtime from `ApplicationDefinition` resources — they are not static CRDs.
-
-## Vendored Code — Critical Rules
-
-**Never suggest editing files inside any `charts/` directory under `packages/`.**
-Those are upstream Helm charts vendored via `make update` (which runs `helm pull`).
-Any direct edit is overwritten on the next update and provides zero value.
-
-If you find an issue that appears to live in vendored chart code:
-
-- For configuration-level changes: suggest overrides in the package root `values.yaml`.
-- For structural changes: suggest a patch file in `packages/<name>/patches/` applied by the Makefile.
-- For source-code changes in images: suggest a patch in `packages/<name>/images/<name>/patches/`.
-- For true upstream bugs: point to the upstream repository and suggest an upstream issue/PR.
-- Do NOT suggest creating `charts/patches/` — patches never live inside `charts/`.
-
-Similarly, never propose edits to:
-
-- `vendor/` — Go dependencies. Changes go through `go get` and `go mod tidy`.
-- `zz_generated.*.go` — regenerated by `make generate`.
-- `pkg/generated/` — auto-generated Kubernetes client code.
-- Image digest values in `values.yaml` — set by CI via `make image`, not by humans.
-- `go.mod` / `go.sum` by hand — use `go get` and `go mod tidy`.
-
-## Commit and PR Requirements
-
-Each commit must follow [Conventional Commits](https://www.conventionalcommits.org/) format: `type(scope): brief description`.
-
-Valid types: `feat`, `fix`, `docs`, `style`, `refactor`, `perf`, `test`, `build`, `ci`, `chore`.
-
-Valid scopes:
-
-- System: `dashboard`, `platform`, `cilium`, `kube-ovn`, `linstor`, `fluxcd`, `cluster-api`
-- Apps: `postgres`, `mariadb`, `redis`, `kafka`, `clickhouse`, `kubernetes`, `virtual-machine`
-- Meta: `api`, `hack`, `tests`, `ci`, `docs`
-- Package-specific: any `<package-name>` matching a directory under `packages/`
-
-Breaking changes: append `!` after type/scope (`feat(api)!: ...`) or add a `BREAKING CHANGE:` footer.
-
-Each commit must have a `Signed-off-by:` trailer (produced by `git commit --signoff`).
-
-PR body must contain a release note block:
-
-````text
-```release-note
-type(scope): human-readable changelog entry
-```
-````
-
-Flag any PR whose commits lack the Conventional Commits format or signoff, or whose body has no release-note block.
-
-## Helm Chart Conventions
-
-Packages follow an umbrella chart pattern:
-
-- `charts/` — vendored upstream, read-only
-- `templates/` — Cozystack-specific extra manifests
-- `values.yaml` — override values for the upstream chart
-- `values.schema.json` — JSON Schema for dashboard UI and input validation
-
-When reviewing `values.schema.json`:
-
-- `make generate` regenerates this file and strips `title`, `description`, and `x-*` custom annotations. Do not suggest adding fields that will be stripped on the next regeneration.
-- Focus on type correctness, `required` fields, `enum` values, and default values.
-- Flag breaking changes: removing a field, changing its type, or narrowing its enum.
-
-## Sensitive Components
-
-**`packages/core/platform/`**: the platform chart that deploys everything. Changes here can require updates to the migration flow — the Helm hook in `packages/core/platform/templates/migration-hook.yaml` and the runner image with scripts in `packages/core/platform/images/migrations/`. Flag any change to this package that lacks a corresponding migration update or an explicit note that backward compatibility is preserved.
-
-**`api/apps/v1alpha1/`**: app CRD Kinds are registered at runtime from `ApplicationDefinition` resources and the matching `values.schema.json`. Suggest changes to the relevant package schema rather than hand-editing generated types.
-
-**RBAC, ServiceAccounts, and SecurityContext**: flag overly broad RBAC (`*` on resources or verbs without justification), missing `securityContext`, containers running as root without an explicit reason, and `hostPath`/`hostNetwork` usage without clear rationale.
-
-## Go Code Standards
-
-- Use controller-runtime patterns for reconcilers.
-- Use structured logging via `logr` — flag `fmt.Print*` and `log.Print*` in controller code.
-- Handle errors explicitly. Discarding meaningful errors with `_` is a bug.
-- Propagate `context.Context` through call chains. Flag `context.Background()` created inside a reconciler or request handler.
-- Prefer `ctrl.Result{RequeueAfter: ...}` over empty requeue for predictable reconciliation loops.
-- Tests live beside the code (`*_test.go`). New behavior without tests is worth flagging.
-
-## What to Review Carefully
-
-- Logic errors, off-by-one bugs, nil dereferences.
-- Missing error handling, especially in reconcilers and API handlers.
-- Helm template correctness: missing `quote`, incorrect indentation, wrong scope in `with`/`range`.
-- Security: permissive RBAC, privileged containers, secrets in environment variables, hardcoded credentials.
-- Missing resource requests/limits on new workloads.
-- Breaking changes in `values.schema.json`: removed fields, tightened types, narrower enums.
-
-## Anti-patterns — Do Not Flag These
-
-- Large JSON files in `dashboards/` — imported from upstream Grafana sources, not hand-written.
-- Files under any `charts/` directory — vendored upstream, left as-is intentionally.
-- Whitespace or formatting in `*.patch` / `*.diff` files — machine-applied, not authored.
-- Missing comments on generated code.
-- `go.sum` changes accompanying `go.mod` changes — expected and correct.
-- Fork relationships for vendored tooling images — intentional (e.g., `cozystack/kilo` fork is expected).
-- Absence of unit tests for vendored chart overrides — covered by E2E tests in `hack/e2e-apps/`.

.github/CODEOWNERS

@@ -1 +1 @@
-* @kvaps @lllamnyp @lexfrei @androndo @IvanHunters @sircthulhu @myasnikovdaniil
+* @kvaps @lllamnyp @lexfrei @androndo @IvanHunters

.github/ISSUE_TEMPLATE/bug_report.md

@@ -1,7 +1,7 @@
 ---
 name: Bug report
 about: Create a report to help us improve
-labels: 'kind/bug'
+labels: 'bug'
 assignees: ''
 
 ---

.github/PULL_REQUEST_TEMPLATE.md

@@ -1,11 +1,8 @@
 <!-- Thank you for making a contribution! Here are some tips for you:
-- Use Conventional Commits for the PR title: `type(scope): description`
-  - Types: feat, fix, docs, style, refactor, perf, test, build, ci, chore
-  - Scopes are not an exhaustive list — pick the most specific scope for the change and extend the list when a genuinely new area appears. Examples:
-    - System components: dashboard, platform, operator, cilium, kube-ovn, linstor, fluxcd, cluster-api
-    - Managed apps: postgres, mariadb, redis, kafka, clickhouse, virtual-machine, kubernetes
-    - Development and maintenance: api, hack, tests, ci, docs, maintenance
-  - Breaking changes: append `!` after type/scope (`feat(api)!: ...`) or add a `BREAKING CHANGE:` footer
+- Start the PR title with the [label] of Cozystack component:
+  - For system components: [platform], [system], [linstor], [cilium], [kube-ovn], [dashboard], [cluster-api], etc.
+  - For managed apps: [apps], [tenant], [kubernetes], [postgres], [virtual-machine] etc.
+  - For development and maintenance: [tests], [ci], [docs], [maintenance].
 - If it's a work in progress, consider creating this PR as a draft.
 - Don't hesistate to ask for opinion and review in the community chats, even if it's still a draft.
 - Add the label `backport` if it's a bugfix that needs to be backported to a previous version.
@@ -14,19 +11,14 @@
 ## What this PR does
 
 
-### Screenshots
-
-<!-- REQUIRED for UI changes: attach screenshots or screen recordings demonstrating
-the visual impact of your changes. PRs with UI changes without screenshots will not be merged. -->
-
 ### Release note
 
 <!--  Write a release note:
 - Explain what has changed internally and for users.
-- Start with the same `type(scope):` prefix as in the PR title
+- Start with the same [label] as in the PR title
 - Follow the guidelines at https://github.com/kubernetes/community/blob/master/contributors/guide/release-notes.md.
 -->
 
 ```release-note
-
+[]
 ```

.github/labels.yml

@@ -1,371 +0,0 @@
-# Cozystack repository labels
-#
-# Label conventions follow the Kubernetes scheme:
-# https://github.com/kubernetes/test-infra/blob/master/label_sync/labels.md
-#
-# Synced into the repository by .github/workflows/labels.yaml
-# (EndBug/label-sync@v2). Edit this file via pull request — UI changes
-# will be overwritten on the next sync.
-#
-# Constraints (enforced by the validate job in labels.yaml):
-#   - description ≤ 100 characters (GitHub REST API limit)
-#   - color is a 6-character hex string (no leading #)
-#   - label names are unique
-#   - aliases do not collide with top-level names
-#
-# Categories:
-#   kind/         issue or PR type
-#   priority/     urgency
-#   triage/       review state
-#   lifecycle/    issue or PR lifecycle
-#   area/         subsystem; extensible — add when 3+ open issues exist
-#   do-not-merge/ PR merge blockers
-#   security/     security-finding severity and status (Cozystack-specific)
-#   size:         PR size (auto-applied)
-#
-# `aliases:` lets EndBug/label-sync rename existing labels without losing
-# references on already-tagged issues and PRs.
-#
-# GitHub-default labels not migrated here (`wontfix`, `invalid`) currently
-# carry zero issues/PRs in this repo and will be removed in a follow-up
-# cleanup PR rather than aliased to a different namespace.
-
-# ──────────────────────────────────────────────
-# kind/ — issue or PR type
-# ──────────────────────────────────────────────
-
-- name: kind/bug
-  color: 'd73a4a'
-  description: Categorizes issue or PR as related to a bug
-  aliases: ['bug']
-
-- name: kind/feature
-  color: 'a2eeef'
-  description: Categorizes issue or PR as related to a new feature
-  aliases: ['enhancement']
-
-- name: kind/documentation
-  color: '0075ca'
-  description: Categorizes issue or PR as related to documentation
-  aliases: ['documentation']
-
-- name: kind/support
-  color: 'd876e3'
-  description: Categorizes issue as a support question
-  aliases: ['question']
-
-- name: kind/cleanup
-  color: 'c7def8'
-  description: Categorizes issue or PR as related to cleanup of code, process, or technical debt
-
-- name: kind/regression
-  color: 'e11d21'
-  description: Categorizes issue or PR as related to a regression from a prior release
-
-- name: kind/flake
-  color: 'f7c6c7'
-  description: Categorizes issue or PR as related to a flaky test
-
-- name: kind/failing-test
-  color: 'e11d21'
-  description: Categorizes issue or PR as related to a consistently or frequently failing test
-
-- name: kind/api-change
-  color: 'c7def8'
-  description: Categorizes issue or PR as related to adding, removing, or otherwise changing an API
-
-- name: kind/breaking-change
-  color: 'e11d21'
-  description: Indicates the change introduces a breaking API or behaviour change
-
-# ──────────────────────────────────────────────
-# priority/ — urgency
-# ──────────────────────────────────────────────
-
-- name: priority/critical-urgent
-  color: 'e11d21'
-  description: Highest priority. Must be actively worked on as someone's top priority right now
-
-- name: priority/important-soon
-  color: 'eb6420'
-  description: Must be staffed and worked on either currently, or very soon, ideally in time for the next release
-
-- name: priority/important-longterm
-  color: 'fbca04'
-  description: Important over the long term, but may not be staffed and/or may need multiple releases to complete
-
-- name: priority/backlog
-  color: 'fef2c0'
-  description: General backlog priority. Lower than priority/important-longterm
-
-# ──────────────────────────────────────────────
-# triage/ — review state
-# ──────────────────────────────────────────────
-
-- name: triage/needs-triage
-  color: 'ededed'
-  description: Indicates an issue needs triage by a maintainer
-
-- name: triage/accepted
-  color: '0e8a16'
-  description: Indicates an issue is ready to be actively worked on
-
-- name: triage/needs-information
-  color: 'fbca04'
-  description: Indicates an issue needs more information in order to work on it
-
-- name: triage/not-reproducible
-  color: 'fbca04'
-  description: Indicates an issue can not be reproduced as described
-
-- name: triage/duplicate
-  color: 'cfd3d7'
-  description: Indicates an issue is a duplicate of another issue
-  aliases: ['duplicate']
-
-- name: triage/unresolved
-  color: 'cfd3d7'
-  description: Indicates an issue that can not or will not be resolved
-
-# ──────────────────────────────────────────────
-# lifecycle/ — issue or PR lifecycle
-# ──────────────────────────────────────────────
-
-- name: lifecycle/active
-  color: '1d76db'
-  description: Indicates that an issue or PR is actively being worked on by a contributor
-
-- name: lifecycle/frozen
-  color: 'db5dd6'
-  description: Indicates that an issue or PR should not be auto-closed due to staleness
-  aliases: ['frozen']
-
-- name: lifecycle/stale
-  color: 'dadada'
-  description: Denotes an issue or PR has remained open with no activity and has become stale
-  aliases: ['stale']
-
-- name: lifecycle/rotten
-  color: '795548'
-  description: Denotes an issue or PR that has aged beyond stale and will be auto-closed
-
-# ──────────────────────────────────────────────
-# area/ — subsystem (extensible)
-# Add a new area/* when there are 3+ open issues on the topic.
-# ──────────────────────────────────────────────
-
-- name: area/api
-  color: 'bfd4f2'
-  description: Issues or PRs related to the cozystack-api aggregated API server
-
-- name: area/ai
-  color: 'bfd4f2'
-  description: Issues or PRs related to AI agent guides, AGENTS.md, docs/agents/
-
-- name: area/build
-  color: 'bfd4f2'
-  description: Issues or PRs related to image build infrastructure, multi-arch support
-
-- name: area/ci
-  color: 'bfd4f2'
-  description: Issues or PRs related to CI workflows, GitHub Actions, automation
-
-- name: area/dashboard
-  color: 'bfd4f2'
-  description: Issues or PRs related to the dashboard / UI
-
-- name: area/extra
-  color: 'bfd4f2'
-  description: Issues or PRs related to tenant-specific modules (packages/extra/)
-
-- name: area/database
-  color: 'bfd4f2'
-  description: Issues or PRs related to managed databases (postgres, mariadb, redis, etcd, kafka, clickhouse)
-
-- name: area/kubernetes
-  color: 'bfd4f2'
-  description: Issues or PRs related to the tenant Kubernetes app
-
-- name: area/monitoring
-  color: 'bfd4f2'
-  description: Issues or PRs related to the monitoring stack (vlogs, vmstack, grafana, workloadmonitor)
-
-- name: area/networking
-  color: 'bfd4f2'
-  description: Issues or PRs related to networking (ingress, gateway, vpn, metallb, cilium, kube-ovn)
-
-- name: area/platform
-  color: 'bfd4f2'
-  description: Issues or PRs related to platform infrastructure (bundle, flux, talos, installer)
-
-- name: area/release
-  color: 'bfd4f2'
-  description: Issues or PRs related to release tooling (changelog, backport, release pipeline)
-
-- name: area/storage
-  color: 'bfd4f2'
-  description: Issues or PRs related to storage (linstor, seaweedfs, bucket, velero, harbor)
-
-- name: area/testing
-  color: 'bfd4f2'
-  description: Issues or PRs related to testing (e2e, bats, unit tests)
-
-- name: area/virtualization
-  color: 'bfd4f2'
-  description: Issues or PRs related to virtualization (kubevirt, cdi, vmi, vm-import)
-
-- name: area/uncategorized
-  color: 'fbca04'
-  description: PR auto-labeler could not map title scope to a known area/*; please review
-
-# ──────────────────────────────────────────────
-# do-not-merge/ — PR merge blockers (Prow convention)
-# ──────────────────────────────────────────────
-
-- name: do-not-merge/work-in-progress
-  color: 'e11d21'
-  description: Indicates that a PR should not merge because it is a work in progress
-  # Both legacy spellings collapse here. EndBug processes aliases sequentially;
-  # the second rename hits a name collision and logs a warning — the legacy
-  # label survives and gets cleaned up in the follow-up dedup PR.
-  aliases: ['do-not-merge', 'do not merge']
-
-- name: do-not-merge/hold
-  color: 'e11d21'
-  description: Indicates that a PR should not merge because someone has issued /hold
-
-# ──────────────────────────────────────────────
-# Cozystack-specific (preserved)
-# ──────────────────────────────────────────────
-
-- name: epic
-  color: 'a335ee'
-  description: A large development increment that brings definite value to Cozystack users
-
-- name: community
-  color: '97458a'
-  description: Community contributions are welcome in this issue
-
-- name: help wanted
-  color: '008672'
-  description: Extra attention is needed
-
-- name: good first issue
-  color: '7057ff'
-  description: Good for newcomers
-
-- name: quality-of-life
-  color: 'aaaaaa'
-  description: QoL improvements
-
-- name: upstream-issue
-  color: 'aaaaaa'
-  description: Requires resolving an issue in an upstream project
-
-- name: backport
-  color: 'fbca04'
-  description: Should change be backported on previous release
-
-- name: backport-previous
-  color: 'fbd876'
-  description: Backport target — previous release line
-
-- name: release
-  color: 'aaaaaa'
-  description: Releasing a new Cozystack version
-
-- name: automated
-  color: 'ededed'
-  description: Created by automation
-
-- name: debug
-  color: '704479'
-  description: Debugging in progress
-
-- name: sponsored
-  color: '00ff00'
-  description: Sponsored work
-
-- name: lgtm
-  color: '238636'
-  description: This PR has been approved by a maintainer
-
-- name: ok-to-test
-  color: '00ff00'
-  description: Indicates a non-member PR is safe to run CI on
-
-# ──────────────────────────────────────────────
-# size: — PR size (auto-applied by sizing bot)
-# ──────────────────────────────────────────────
-
-- name: 'size:XS'
-  color: '00ff00'
-  description: This PR changes 0-9 lines, ignoring generated files
-
-- name: 'size:S'
-  color: '77b800'
-  description: This PR changes 10-29 lines, ignoring generated files
-
-- name: 'size:M'
-  color: 'ebb800'
-  description: This PR changes 30-99 lines, ignoring generated files
-
-- name: 'size:L'
-  color: 'eb9500'
-  description: This PR changes 100-499 lines, ignoring generated files
-
-- name: 'size:XL'
-  color: 'ff823f'
-  description: This PR changes 500-999 lines, ignoring generated files
-
-- name: 'size:XXL'
-  color: 'ffb8b8'
-  description: This PR changes 1000+ lines, ignoring generated files
-
-# ──────────────────────────────────────────────
-# security/ — security-finding severity and status
-# ──────────────────────────────────────────────
-
-- name: security
-  color: 'aaaaaa'
-  description: Security-related issues and features
-
-- name: security/critical
-  color: 'd73a4a'
-  description: Critical security vulnerability
-
-- name: security/high
-  color: 'e99695'
-  description: High severity security finding
-
-- name: security/medium
-  color: 'f9c513'
-  description: Medium severity security finding
-
-- name: security/low
-  color: '0e8a16'
-  description: Low severity security finding
-
-- name: security/triage-needed
-  color: 'fbca04'
-  description: Needs security triage
-
-- name: security/confirmed
-  color: '1d76db'
-  description: Confirmed vulnerability
-
-- name: security/false-positive
-  color: 'c5def5'
-  description: Triaged as false positive
-
-- name: security/accepted-risk
-  color: 'bfd4f2'
-  description: Risk accepted with justification
-
-- name: security/in-progress
-  color: '0075ca'
-  description: Fix in progress
-
-- name: security/fixed
-  color: '0e8a16'
-  description: Fix released

.github/workflows/auto-release.yaml

@@ -20,14 +20,6 @@ jobs:
       pull-requests: read
 
     steps:
-      - name: Generate GitHub App token
-        id: app-token
-        uses: actions/create-github-app-token@v1
-        with:
-          app-id: ${{ secrets.COZYSTACK_CI_APP_ID }}
-          private-key: ${{ secrets.COZYSTACK_CI_PRIVATE_KEY }}
-          owner: cozystack
-
       - name: Checkout code
         uses: actions/checkout@v4
         with:
@@ -36,27 +28,27 @@ jobs:
 
       - name: Configure git
         env:
-          APP_TOKEN: ${{ steps.app-token.outputs.token }}
+          GH_PAT: ${{ secrets.GH_PAT }}
         run: |
-          git config user.name  "cozystack-ci[bot]"
-          git config user.email "274107086+cozystack-ci[bot]@users.noreply.github.com"
-          git remote set-url origin https://x-access-token:${APP_TOKEN}@github.com/${GITHUB_REPOSITORY}
+          git config user.name  "cozystack-bot"
+          git config user.email "217169706+cozystack-bot@users.noreply.github.com"
+          git remote set-url origin https://cozystack-bot:${GH_PAT}@github.com/${GITHUB_REPOSITORY}
           git config --unset-all http.https://github.com/.extraheader || true
 
       - name: Process release branches
         uses: actions/github-script@v7
         env:
-          APP_TOKEN: ${{ steps.app-token.outputs.token }}
+          GH_PAT: ${{ secrets.GH_PAT }}
         with:
-          github-token: ${{ steps.app-token.outputs.token }}
+          github-token: ${{ secrets.GH_PAT }}
           script: |
             const { execSync } = require('child_process');
 
-            // Configure git to use GitHub App token for authentication
-            execSync('git config user.name "cozystack-ci[bot]"', { encoding: 'utf8' });
-            execSync('git config user.email "274107086+cozystack-ci[bot]@users.noreply.github.com"', { encoding: 'utf8' });
-            execSync(`git remote set-url origin https://x-access-token:${process.env.APP_TOKEN}@github.com/${process.env.GITHUB_REPOSITORY}`, { encoding: 'utf8' });
-            // Remove GITHUB_TOKEN extraheader to ensure App token is used (needed to trigger other workflows)
+            // Configure git to use PAT for authentication
+            execSync('git config user.name "cozystack-bot"', { encoding: 'utf8' });
+            execSync('git config user.email "217169706+cozystack-bot@users.noreply.github.com"', { encoding: 'utf8' });
+            execSync(`git remote set-url origin https://cozystack-bot:${process.env.GH_PAT}@github.com/${process.env.GITHUB_REPOSITORY}`, { encoding: 'utf8' });
+            // Remove GITHUB_TOKEN extraheader to ensure PAT is used (needed to trigger other workflows)
             execSync('git config --unset-all http.https://github.com/.extraheader || true', { encoding: 'utf8' });
 
             // Get all release-X.Y branches

.github/workflows/codegen-drift.yml

@@ -1,61 +0,0 @@
-name: Codegen Drift Check
-
-on:
-  pull_request:
-    types: [opened, synchronize, reopened]
-    paths:
-      - 'api/**'
-      - 'pkg/apis/**'
-      - 'pkg/generated/**'
-      - 'internal/crdinstall/manifests/**'
-      - 'packages/system/cozystack-controller/definitions/**'
-      - 'packages/system/application-definition-crd/definition/**'
-      - 'packages/system/backup-controller/definitions/**'
-      - 'packages/system/backupstrategy-controller/definitions/**'
-      - 'hack/update-codegen.sh'
-      - 'hack/boilerplate.go.txt'
-      - 'Makefile'
-      - 'go.mod'
-      - 'go.sum'
-      - '.github/workflows/codegen-drift.yml'
-
-concurrency:
-  group: codegen-drift-${{ github.workflow }}-${{ github.event.pull_request.number }}
-  cancel-in-progress: true
-
-jobs:
-  codegen-drift:
-    name: Verify generated code is up to date
-    runs-on: ubuntu-22.04
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-
-      - name: Set up Go
-        uses: actions/setup-go@v5
-        with:
-          go-version-file: go.mod
-          cache: true
-
-      - name: Pre-fetch k8s.io/code-generator module
-        # hack/update-codegen.sh sources kube_codegen.sh from the Go module cache.
-        # The module is not declared in go.mod, so fetch it explicitly at the
-        # version pinned in the script.
-        run: |
-          version=$(grep -oP 'code-generator@\Kv[0-9.]+' hack/update-codegen.sh)
-          tmpdir=$(mktemp -d)
-          cd "$tmpdir"
-          go mod init codegen-fetch
-          go get "k8s.io/code-generator@${version}"
-
-      - name: Run make generate
-        run: make generate
-
-      - name: Fail on drift
-        run: |
-          if [ -n "$(git status --porcelain)" ]; then
-            echo "::error::'make generate' produced changes. Run 'make generate' locally and commit the result."
-            git status --short
-            git diff --color=always
-            exit 1
-          fi

.github/workflows/labels.yaml

@@ -1,84 +0,0 @@
-name: Labels
-
-on:
-  pull_request:
-    paths:
-      - .github/labels.yml
-      - .github/workflows/labels.yaml
-  push:
-    branches: [main]
-    paths:
-      - .github/labels.yml
-      - .github/workflows/labels.yaml
-  workflow_dispatch:
-  schedule:
-    - cron: '17 4 * * 1'  # Mondays at 04:17 UTC
-
-permissions:
-  contents: read
-
-concurrency:
-  group: labels-sync
-  cancel-in-progress: false
-
-jobs:
-  validate:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Validate labels.yml schema
-        run: |
-          python3 - <<'PY'
-          import re, sys, yaml
-
-          path = '.github/labels.yml'
-          data = yaml.safe_load(open(path))
-          errors = []
-
-          # 1. description ≤ 100 chars (GitHub REST API limit)
-          for label in data:
-              desc = label.get('description', '') or ''
-              if len(desc) > 100:
-                  errors.append(f"{label['name']}: description {len(desc)} chars (max 100)")
-
-          # 2. color is 6-char hex without leading #
-          for label in data:
-              color = label.get('color', '') or ''
-              if not re.match(r'^[0-9A-Fa-f]{6}$', color):
-                  errors.append(f"{label['name']}: bad color {color!r} (must be 6-char hex without #)")
-
-          # 3. unique top-level names
-          names = [label['name'] for label in data]
-          dups = sorted({n for n in names if names.count(n) > 1})
-          for n in dups:
-              errors.append(f"duplicate name: {n}")
-
-          # 4. aliases do not collide with any top-level name
-          name_set = set(names)
-          for label in data:
-              for alias in (label.get('aliases') or []):
-                  if alias in name_set:
-                      errors.append(f"alias {alias!r} (under {label['name']!r}) collides with a top-level name")
-
-          if errors:
-              for err in errors:
-                  print(f"::error::{err}")
-              sys.exit(1)
-
-          print(f"labels.yml schema OK ({len(data)} labels)")
-          PY
-
-  sync:
-    needs: validate
-    if: github.event_name != 'pull_request'
-    runs-on: ubuntu-latest
-    permissions:
-      issues: write
-      pull-requests: write
-    steps:
-      - uses: actions/checkout@v4
-      - uses: EndBug/label-sync@v2
-        with:
-          config-file: .github/labels.yml
-          delete-other-labels: false

.github/workflows/pr-labeler.yaml

@@ -1,206 +0,0 @@
-name: PR Auto-Label
-
-on:
-  pull_request_target:
-    types: [opened, edited, reopened, synchronize]
-
-permissions:
-  contents: read
-  pull-requests: write
-
-jobs:
-  label:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Apply labels from PR title
-        uses: actions/github-script@v7
-        with:
-          script: |
-            // Conventional Commits types accepted by Cozystack (per docs/agents/contributing.md):
-            //   feat, fix, docs, style, refactor, perf, test, build, ci, chore, revert
-            // Mapping below maps a subset to kind/* — types not listed do not produce a kind/*.
-            const typeToKind = {
-              feat:     'kind/feature',
-              fix:      'kind/bug',
-              docs:     'kind/documentation',
-              chore:    'kind/cleanup',
-              refactor: 'kind/cleanup',
-              // style, perf, test, build, ci, revert — no kind mapping
-            };
-
-            // scope -> area/* mapping. Keys are the scopes observed in cozystack issues
-            // and PRs. Add new entries when a scope recurs (3+ times).
-            const scopeToArea = {
-              // area/api
-              'api':                 'area/api',
-              'cozystack-api':       'area/api',
-
-              // area/ai
-              'agents':              'area/ai',
-              'ai':                  'area/ai',
-
-              // area/build
-              'build':               'area/build',
-
-              // area/ci
-              'ci':                  'area/ci',
-
-              // area/dashboard
-              'dashboard':           'area/dashboard',
-
-              // area/database
-              'postgres':            'area/database',
-              'postgres-operator':   'area/database',
-              'mariadb':             'area/database',
-              'mariadb-operator':    'area/database',
-              'redis':               'area/database',
-              'etcd':                'area/database',
-              'kafka':               'area/database',
-              'clickhouse':          'area/database',
-
-              // area/extra
-              'extra':               'area/extra',
-
-              // area/kubernetes
-              'kubernetes':          'area/kubernetes',
-              'apps/kubernetes':     'area/kubernetes',
-
-              // area/monitoring
-              'monitoring':          'area/monitoring',
-              'vlogs':               'area/monitoring',
-              'vmstack':             'area/monitoring',
-              'grafana':             'area/monitoring',
-              'workloadmonitor':     'area/monitoring',
-
-              // area/networking
-              'ingress':             'area/networking',
-              'ingress-nginx':       'area/networking',
-              'gateway':             'area/networking',
-              'vpn':                 'area/networking',
-              'metallb':             'area/networking',
-              'cilium':              'area/networking',
-              'kube-ovn':            'area/networking',
-              'tcp-balancer':        'area/networking',
-              'securitygroups':      'area/networking',
-              'cozy-proxy':          'area/networking',
-
-              // area/platform
-              'platform':            'area/platform',
-              'bundle':              'area/platform',
-              'flux':                'area/platform',
-              'fluxcd':              'area/platform',
-              'cluster-api':         'area/platform',
-              'talos':               'area/platform',
-              'installer':           'area/platform',
-              'cozyctl':             'area/platform',
-              'cozystack-engine':    'area/platform',
-              'cozy-lib':            'area/platform',
-
-              // area/release
-              'backport':            'area/release',
-              'release':             'area/release',
-
-              // area/storage
-              'seaweedfs':           'area/storage',
-              'seaweedfs-cosi-driver': 'area/storage',
-              'bucket':              'area/storage',
-              'linstor':             'area/storage',
-              'velero':              'area/storage',
-              'harbor':              'area/storage',
-              'backups':             'area/storage',
-
-              // area/testing
-              'tests':               'area/testing',
-              'e2e':                 'area/testing',
-
-              // area/virtualization
-              'kubevirt':            'area/virtualization',
-              'cdi':                 'area/virtualization',
-              'vmi':                 'area/virtualization',
-              'vm-import':           'area/virtualization',
-              'virtual-machine':     'area/virtualization',
-              'hami':                'area/virtualization',
-              'gpu-operator':        'area/virtualization',
-            };
-
-            const pr = context.payload.pull_request;
-            const title = pr.title || '';
-            const body  = pr.body  || '';
-            const existing = new Set((pr.labels || []).map(l => l.name));
-            const toAdd = new Set();
-
-            // 1. Strip "[Backport release-1.x]" prefix if present.
-            const backportMatch = title.match(/^\[Backport ([^\]]+)\]\s+(.+)$/);
-            const cleanTitle = backportMatch ? backportMatch[2] : title;
-            if (backportMatch) {
-              toAdd.add('area/release');
-              toAdd.add('backport');
-            }
-
-            // 2. Try Conventional Commits form: type(scope)?(!)?: description
-            const conv = cleanTitle.match(/^([a-z]+)(?:\(([^)]+)\))?(!)?:\s*.+$/);
-            // 3. Fall back to bracket form: [scope] description
-            const bracket = !conv && cleanTitle.match(/^\[([^\]]+)\]\s+.+$/);
-
-            let type = null, scopeStr = null, breaking = false;
-            if (conv) {
-              type = conv[1];
-              scopeStr = conv[2] || null;
-              breaking = !!conv[3];
-            } else if (bracket) {
-              scopeStr = bracket[1];
-            }
-
-            // 4. Detect BREAKING CHANGE: or BREAKING-CHANGE: footer in body.
-            // Conventional Commits 1.0 spec item 16 treats them as synonymous.
-            if (/^BREAKING[ -]CHANGE:/m.test(body)) {
-              breaking = true;
-            }
-
-            // 5. Apply kind/* from type.
-            if (type) {
-              if (typeToKind[type]) {
-                toAdd.add(typeToKind[type]);
-              } else {
-                core.warning(`type "${type}" has no kind/* mapping — typo or new type? See .github/workflows/pr-labeler.yaml typeToKind`);
-              }
-            }
-
-            // 6. Apply area/* from scope. Composite scopes split on comma.
-            const scopes = (scopeStr || '')
-              .split(/,\s*/)
-              .map(s => s.trim())
-              .filter(Boolean);
-            for (const s of scopes) {
-              if (scopeToArea[s]) {
-                toAdd.add(scopeToArea[s]);
-              } else {
-                core.warning(`scope "${s}" has no area/* mapping — consider extending scopeToArea in .github/workflows/pr-labeler.yaml if it recurs`);
-              }
-            }
-
-            // 7. kind/breaking-change.
-            if (breaking) {
-              toAdd.add('kind/breaking-change');
-            }
-
-            // 8. Fallback: no area/* applied -> area/uncategorized.
-            const hasArea = [...toAdd].some(l => l.startsWith('area/'));
-            if (!hasArea) {
-              toAdd.add('area/uncategorized');
-            }
-
-            // 9. Additive only — never remove existing labels.
-            const newLabels = [...toAdd].filter(l => !existing.has(l));
-            if (newLabels.length === 0) {
-              core.info('No new labels to apply');
-              return;
-            }
-
-            await github.rest.issues.addLabels({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              issue_number: pr.number,
-              labels: newLabels,
-            });
-            core.info(`Applied labels: ${newLabels.join(', ')}`);

.github/workflows/pre-commit.yml

@@ -28,7 +28,7 @@ jobs:
 
       - name: Install generate
         run: |
-          curl -sSL https://github.com/cozystack/cozyvalues-gen/releases/download/v1.3.0/cozyvalues-gen-linux-amd64.tar.gz | tar -xzvf- -C /usr/local/bin/ cozyvalues-gen
+          curl -sSL https://github.com/cozystack/cozyvalues-gen/releases/download/v1.0.6/cozyvalues-gen-linux-amd64.tar.gz | tar -xzvf- -C /usr/local/bin/ cozyvalues-gen
 
       - name: Run pre-commit hooks
         run: |

.github/workflows/pull-requests-release.yaml

@@ -23,14 +23,6 @@ jobs:
       contains(github.event.pull_request.labels.*.name, 'release')
 
     steps:
-      - name: Generate GitHub App token
-        id: app-token
-        uses: actions/create-github-app-token@v1
-        with:
-          app-id: ${{ secrets.COZYSTACK_CI_APP_ID }}
-          private-key: ${{ secrets.COZYSTACK_CI_PRIVATE_KEY }}
-          owner: cozystack
-
       # Extract tag from branch name  (branch = release-X.Y.Z*)
       - name: Extract tag from branch name
         id: get_tag
@@ -55,11 +47,11 @@ jobs:
 
       - name: Create tag on merge commit
         env:
-          APP_TOKEN: ${{ steps.app-token.outputs.token }}
+          GH_PAT: ${{ secrets.GH_PAT }}
         run: |
-          git config user.name  "cozystack-ci[bot]"
-          git config user.email "274107086+cozystack-ci[bot]@users.noreply.github.com"
-          git remote set-url origin https://x-access-token:${APP_TOKEN}@github.com/${GITHUB_REPOSITORY}
+          git config user.name  "cozystack-bot"
+          git config user.email "217169706+cozystack-bot@users.noreply.github.com"
+          git remote set-url origin https://cozystack-bot:${GH_PAT}@github.com/${GITHUB_REPOSITORY}
           git tag -f ${{ steps.get_tag.outputs.tag }} ${{ github.sha }}
           git push -f origin ${{ steps.get_tag.outputs.tag }}
 
@@ -67,7 +59,7 @@ jobs:
       - name: Ensure maintenance branch release-X.Y
         uses: actions/github-script@v7
         with:
-          github-token: ${{ steps.app-token.outputs.token }}
+          github-token: ${{ secrets.GH_PAT }}
           script: |
             const tag = '${{ steps.get_tag.outputs.tag }}';  // e.g. v0.1.3 or v0.1.3-rc3
             const match = tag.match(/^v(\d+)\.(\d+)\.\d+(?:[-\w\.]+)?$/);

.github/workflows/pull-requests.yaml

@@ -6,6 +6,8 @@ env:
 on:
   pull_request:
     types: [opened, synchronize, reopened]
+    paths-ignore:
+      - 'docs/**/*'
 
 # Cancel in‑flight runs for the same PR when a new push arrives.
 concurrency:
@@ -13,32 +15,16 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
-  detect-changes:
-    name: Detect changes
-    runs-on: ubuntu-latest
-    outputs:
-      code: ${{ steps.filter.outputs.code }}
-    steps:
-      - uses: dorny/paths-filter@v3
-        id: filter
-        with:
-          filters: |
-            code:
-              - '!docs/**'
-
   build:
     name: Build
     runs-on: [self-hosted]
-    timeout-minutes: 30
     permissions:
       contents: read
       packages: write
 
-    needs: ["detect-changes"]
-    # Never run when the PR carries the "release" label or only docs changed.
+    # Never run when the PR carries the "release" label.
     if: |
-      needs.detect-changes.outputs.code == 'true'
-      && !contains(github.event.pull_request.labels.*.name, 'release')
+      !contains(github.event.pull_request.labels.*.name, 'release')
 
     steps:
       - name: Checkout code
@@ -99,14 +85,6 @@ jobs:
       disk_id:      ${{ steps.fetch_assets.outputs.disk_id }}
 
     steps:
-      - name: Generate GitHub App token
-        id: app-token
-        uses: actions/create-github-app-token@v1
-        with:
-          app-id: ${{ secrets.COZYSTACK_CI_APP_ID }}
-          private-key: ${{ secrets.COZYSTACK_CI_PRIVATE_KEY }}
-          owner: cozystack
-
       - name: Checkout code
         if: contains(github.event.pull_request.labels.*.name, 'release')
         uses: actions/checkout@v4
@@ -133,7 +111,7 @@ jobs:
         id: fetch_assets
         uses: actions/github-script@v7
         with:
-          github-token: ${{ steps.app-token.outputs.token }}
+          github-token: ${{ secrets.GH_PAT }}
           script: |
             const tag = '${{ steps.get_tag.outputs.tag }}';
             const releases = await github.rest.repos.listReleases({
@@ -159,7 +137,6 @@ jobs:
     name: "E2E Tests"
     runs-on: ${{ contains(github.event.pull_request.labels.*.name, 'debug') && 'self-hosted' || 'oracle-vm-24cpu-96gb-x86-64' }}
     #runs-on: [oracle-vm-32cpu-128gb-x86-64]
-    timeout-minutes: 120
     permissions:
       contents: read
       packages: read
@@ -167,15 +144,6 @@ jobs:
     if: ${{ always() && (needs.build.result == 'success' || needs.resolve_assets.result == 'success') }}
 
     steps:
-      - name: Generate GitHub App token
-        if: contains(github.event.pull_request.labels.*.name, 'release')
-        id: app-token
-        uses: actions/create-github-app-token@v1
-        with:
-          app-id: ${{ secrets.COZYSTACK_CI_APP_ID }}
-          private-key: ${{ secrets.COZYSTACK_CI_PRIVATE_KEY }}
-          owner: cozystack
-
       # ▸ Checkout and prepare the codebase
       - name: Checkout code
         uses: actions/checkout@v4
@@ -205,11 +173,11 @@ jobs:
         if: contains(github.event.pull_request.labels.*.name, 'release')
         run: |
           mkdir -p _out/assets
-          curl -sSL -H "Authorization: token ${APP_TOKEN}" -H "Accept: application/octet-stream" \
+          curl -sSL -H "Authorization: token ${GH_PAT}" -H "Accept: application/octet-stream" \
             -o _out/assets/nocloud-amd64.raw.xz \
             "https://api.github.com/repos/${GITHUB_REPOSITORY}/releases/assets/${{ needs.resolve_assets.outputs.disk_id }}"
         env:
-          APP_TOKEN: ${{ steps.app-token.outputs.token }}
+          GH_PAT: ${{ secrets.GH_PAT }}
 
       - name: Set sandbox ID
         run: echo "SANDBOX_NAME=cozy-e2e-sandbox-$(echo "${GITHUB_REPOSITORY}:${GITHUB_WORKFLOW}:${GITHUB_REF}" | sha256sum | cut -c1-10)" >> $GITHUB_ENV

.github/workflows/tags.yaml

@@ -16,8 +16,6 @@ jobs:
   prepare-release:
     name: Prepare Release
     runs-on: [self-hosted]
-    outputs:
-      skip: ${{ steps.check_release.outputs.skip }}
     permissions:
       contents: write
       packages: write
@@ -25,14 +23,6 @@ jobs:
       actions: write
 
     steps:
-      - name: Generate GitHub App token
-        id: app-token
-        uses: actions/create-github-app-token@v1
-        with:
-          app-id: ${{ secrets.COZYSTACK_CI_APP_ID }}
-          private-key: ${{ secrets.COZYSTACK_CI_PRIVATE_KEY }}
-          owner: cozystack
-
       # Check if a non-draft release with this tag already exists
       - name: Check if release already exists
         id: check_release
@@ -123,29 +113,15 @@ jobs:
       - name: Commit release artifacts
         if: steps.check_release.outputs.skip == 'false'
         env:
-          APP_TOKEN: ${{ steps.app-token.outputs.token }}
+          GH_PAT: ${{ secrets.GH_PAT }}
         run: |
-          git config user.name  "cozystack-ci[bot]"
-          git config user.email "274107086+cozystack-ci[bot]@users.noreply.github.com"
-          git remote set-url origin https://x-access-token:${APP_TOKEN}@github.com/${GITHUB_REPOSITORY}
+          git config user.name  "cozystack-bot"
+          git config user.email "217169706+cozystack-bot@users.noreply.github.com"
+          git remote set-url origin https://cozystack-bot:${GH_PAT}@github.com/${GITHUB_REPOSITORY}
           git config --unset-all http.https://github.com/.extraheader || true
           git add .
           git commit -m "Prepare release ${GITHUB_REF#refs/tags/}" -s || echo "No changes to commit"
-
-      # Tag the api/apps/v1alpha1 submodule for pkg.go.dev
-      - name: Tag API submodule
-        if: steps.check_release.outputs.skip == 'false'
-        env:
-          APP_TOKEN: ${{ steps.app-token.outputs.token }}
-        run: |
-          VTAG="${{ steps.tag.outputs.tag }}"
-          SUBTAG="api/apps/v1alpha1/${VTAG}"
-          git config user.name  "cozystack-ci[bot]"
-          git config user.email "274107086+cozystack-ci[bot]@users.noreply.github.com"
-          git remote set-url origin https://x-access-token:${APP_TOKEN}@github.com/${GITHUB_REPOSITORY}
-          TARGET="$(git rev-parse "${VTAG}^{}")"
-          git tag -f "${SUBTAG}" "$TARGET"
-          git push -f origin "refs/tags/${SUBTAG}"
+          git push origin HEAD || true
 
       # Create or reuse draft release
       - name: Create / reuse draft release
@@ -191,11 +167,11 @@ jobs:
       - name: Create release branch
         if: steps.check_release.outputs.skip == 'false'
         env:
-          APP_TOKEN: ${{ steps.app-token.outputs.token }}
+          GH_PAT: ${{ secrets.GH_PAT }}
         run: |
-          git config user.name  "cozystack-ci[bot]"
-          git config user.email "274107086+cozystack-ci[bot]@users.noreply.github.com"
-          git remote set-url origin https://x-access-token:${APP_TOKEN}@github.com/${GITHUB_REPOSITORY}
+          git config user.name  "cozystack-bot"
+          git config user.email "217169706+cozystack-bot@users.noreply.github.com"
+          git remote set-url origin https://cozystack-bot:${GH_PAT}@github.com/${GITHUB_REPOSITORY}
           BRANCH="release-${GITHUB_REF#refs/tags/v}"
           git branch -f "$BRANCH"
           git push -f origin "$BRANCH"
@@ -205,7 +181,7 @@ jobs:
         if: steps.check_release.outputs.skip == 'false'
         uses: actions/github-script@v7
         with:
-          github-token: ${{ steps.app-token.outputs.token }}
+          github-token: ${{ secrets.GH_PAT }}
           script: |
             const version = context.ref.replace('refs/tags/v', '');
             const base    = '${{ steps.get_base.outputs.branch }}';
@@ -223,7 +199,7 @@ jobs:
                 repo:  context.repo.repo,
                 head,
                 base,
-                title: `chore(release): cut v${version}`,
+                title: `Release v${version}`,
                 body:  `This PR prepares the release \`v${version}\`.`,
                 draft: false
               });
@@ -247,29 +223,6 @@ jobs:
       pull-requests: write
     if: needs.prepare-release.result == 'success'
     steps:
-      - name: Generate GitHub App token
-        id: app-token
-        uses: actions/create-github-app-token@v1
-        with:
-          app-id: ${{ secrets.COZYSTACK_CI_APP_ID }}
-          private-key: ${{ secrets.COZYSTACK_CI_PRIVATE_KEY }}
-          owner: cozystack
-
-      # Read-only token for the AI step. Minting a separate scoped token
-      # means the Generate changelog using AI step cannot push branches,
-      # open PRs, or mutate any repository even with --allow-all-tools,
-      # regardless of whether the agent follows the prompt's instructions.
-      - name: Generate read-only GitHub App token
-        id: app-token-read
-        uses: actions/create-github-app-token@v1
-        with:
-          app-id: ${{ secrets.COZYSTACK_CI_APP_ID }}
-          private-key: ${{ secrets.COZYSTACK_CI_PRIVATE_KEY }}
-          owner: cozystack
-          permission-contents: read
-          permission-pull-requests: read
-          permission-metadata: read
-
       - name: Parse tag
         id: tag
         uses: actions/github-script@v7
@@ -292,7 +245,7 @@ jobs:
           ref: main
           fetch-depth: 0
           fetch-tags: true
-          token: ${{ steps.app-token.outputs.token }}
+          token: ${{ secrets.GH_PAT }}
 
       - name: Check if changelog already exists
         id: check_changelog
@@ -318,65 +271,56 @@ jobs:
 
       - name: Generate changelog using AI
         if: steps.check_changelog.outputs.exists == 'false'
-        timeout-minutes: 30
         env:
           COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}
-          GH_TOKEN: ${{ steps.app-token-read.outputs.token }}
-          VERSION: ${{ steps.tag.outputs.version }}
+          GH_TOKEN: ${{ secrets.GH_PAT }}
         run: |
-          copilot \
-            --prompt "Generate the release changelog for tag v${VERSION}. Follow the instructions in @docs/agents/changelog.md exactly, including the 'Scope and boundaries' section at the top. Your deliverable is the single file docs/changelogs/v${VERSION}.md — write it and exit; this workflow handles branching, committing, pushing, and opening the PR." \
+          copilot --prompt "prepare changelog file for tagged release v${{ steps.tag.outputs.version }}, use @docs/agents/changelog.md for it. Create the changelog file at docs/changelogs/v${{ steps.tag.outputs.version }}.md" \
             --allow-all-tools --allow-all-paths < /dev/null
 
       - name: Create changelog branch and commit
         if: steps.check_changelog.outputs.exists == 'false'
         env:
-          APP_TOKEN: ${{ steps.app-token.outputs.token }}
-          VERSION: ${{ steps.tag.outputs.version }}
+          GH_PAT: ${{ secrets.GH_PAT }}
         run: |
-          set -euo pipefail
-
-          CHANGELOG_FILE="docs/changelogs/v${VERSION}.md"
-          CHANGELOG_BRANCH="changelog-v${VERSION}"
-
-          if [ ! -f "$CHANGELOG_FILE" ]; then
-            echo "::error::Changelog file $CHANGELOG_FILE was not produced by the Generate changelog using AI step"
+          git config user.name  "cozystack-bot"
+          git config user.email "217169706+cozystack-bot@users.noreply.github.com"
+          git remote set-url origin https://cozystack-bot:${GH_PAT}@github.com/${GITHUB_REPOSITORY}
+          
+          CHANGELOG_FILE="docs/changelogs/v${{ steps.tag.outputs.version }}.md"
+          CHANGELOG_BRANCH="changelog-v${{ steps.tag.outputs.version }}"
+          
+          if [ -f "$CHANGELOG_FILE" ]; then
+            # Fetch latest main branch
+            git fetch origin main
+            
+            # Delete local branch if it exists
+            git branch -D "$CHANGELOG_BRANCH" 2>/dev/null || true
+            
+            # Create and checkout new branch from main
+            git checkout -b "$CHANGELOG_BRANCH" origin/main
+            
+            # Add and commit changelog
+            git add "$CHANGELOG_FILE"
+            if git diff --staged --quiet; then
+              echo "⚠️ No changes to commit (file may already be committed)"
+            else
+              git commit -m "docs: add changelog for v${{ steps.tag.outputs.version }}" -s
+              echo "✅ Changelog committed to branch $CHANGELOG_BRANCH"
+            fi
+            
+            # Push the branch (force push to update if it exists)
+            git push -f origin "$CHANGELOG_BRANCH"
+          else
+            echo "⚠️ Changelog file was not generated"
             exit 1
           fi
-          if [ ! -s "$CHANGELOG_FILE" ]; then
-            echo "::error::Changelog file $CHANGELOG_FILE is empty"
-            exit 1
-          fi
-
-          # Snapshot the file across the branch switch — the checkout below
-          # resets tracked files to match origin/main.
-          TEMP_FILE="$(mktemp)"
-          trap 'rm -f "$TEMP_FILE"' EXIT
-          cp "$CHANGELOG_FILE" "$TEMP_FILE"
-
-          git config user.name  "cozystack-ci[bot]"
-          git config user.email "274107086+cozystack-ci[bot]@users.noreply.github.com"
-          git remote set-url origin "https://x-access-token:${APP_TOKEN}@github.com/${GITHUB_REPOSITORY}"
-
-          git fetch origin main
-          git branch -D "$CHANGELOG_BRANCH" 2>/dev/null || true
-          git checkout -b "$CHANGELOG_BRANCH" origin/main
-
-          mkdir -p "$(dirname "$CHANGELOG_FILE")"
-          cp "$TEMP_FILE" "$CHANGELOG_FILE"
-
-          # The `check_changelog` step gated this job on the file being absent
-          # from origin/main, so `git add` + `git commit` must produce a diff.
-          # If they don't, something is wrong (e.g. empty file) — fail loud.
-          git add "$CHANGELOG_FILE"
-          git commit -m "docs: add changelog for v${VERSION}" -s
-          git push -f origin "$CHANGELOG_BRANCH"
 
       - name: Create PR for changelog
         if: steps.check_changelog.outputs.exists == 'false'
         uses: actions/github-script@v7
         with:
-          github-token: ${{ steps.app-token.outputs.token }}
+          github-token: ${{ secrets.GH_PAT }}
           script: |
             const version = '${{ steps.tag.outputs.version }}';
             const changelogBranch = `changelog-v${version}`;
@@ -411,7 +355,7 @@ jobs:
                 repo:  context.repo.repo,
                 head:  changelogBranch,
                 base:  baseBranch,
-                title: `docs(release): add changelog for v${version}`,
+                title: `docs: add changelog for v${version}`,
                 body:  `This PR adds the changelog for release \`v${version}\`.\n\n✅ Changelog has been automatically generated in \`docs/changelogs/v${version}.md\`.`,
                 draft: false
               });
@@ -421,128 +365,8 @@ jobs:
                 owner: context.repo.owner,
                 repo:  context.repo.repo,
                 issue_number: pr.data.number,
-                labels: ['kind/documentation', 'automated']
+                labels: ['documentation', 'automated']
               });
               
               console.log(`Created PR #${pr.data.number} for changelog`);
             }
-
-  update-website-docs:
-    name: Update Website Docs
-    runs-on: [self-hosted]
-    needs: [generate-changelog, prepare-release]
-    if: needs.generate-changelog.result == 'success' && needs.prepare-release.outputs.skip != 'true'
-    permissions:
-      contents: read
-    steps:
-      - name: Generate GitHub App token
-        id: app-token
-        uses: actions/create-github-app-token@v1
-        with:
-          app-id: ${{ secrets.COZYSTACK_CI_APP_ID }}
-          private-key: ${{ secrets.COZYSTACK_CI_PRIVATE_KEY }}
-          owner: cozystack
-
-      - name: Parse tag
-        id: tag
-        uses: actions/github-script@v7
-        with:
-          script: |
-            const ref = context.ref.replace('refs/tags/', '');
-            const m = ref.match(/^v(\d+\.\d+\.\d+)(-(?:alpha|beta|rc)\.\d+)?$/);
-            if (!m) {
-              core.setFailed(`❌ tag '${ref}' must match 'vX.Y.Z' or 'vX.Y.Z-(alpha|beta|rc).N'`);
-              return;
-            }
-            const version = m[1] + (m[2] ?? '');
-            core.setOutput('tag',     ref);      // v0.22.0
-            core.setOutput('version', version);  // 0.22.0
-
-      - name: Checkout website repo
-        uses: actions/checkout@v4
-        with:
-          repository: cozystack/website
-          token: ${{ steps.app-token.outputs.token }}
-          ref: main
-
-      # Decide whether this release promotes the `next/` trunk to a new released
-      # version directory. Per the website repo's contract (see website#495):
-      #   - `make release-next` runs only for new minor/major final releases
-      #     (tag matches `vX.Y.Z` with no prerelease suffix AND `vX.Y/` does
-      #     not yet exist on disk).
-      #   - Prereleases and patch releases skip this step and let
-      #     `make update-all` handle routing on its own.
-      - name: Determine if this release promotes next/
-        id: promote
-        env:
-          TAG: ${{ steps.tag.outputs.tag }}
-        run: |
-          if [[ ! "$TAG" =~ ^v([0-9]+)\.([0-9]+)\.([0-9]+)$ ]]; then
-            echo "promote=false" >> "$GITHUB_OUTPUT"
-            echo "Prerelease tag '$TAG' — skipping release-next."
-            exit 0
-          fi
-          MAJOR="${BASH_REMATCH[1]}"
-          MINOR="${BASH_REMATCH[2]}"
-          if [[ "$MAJOR" == "0" ]]; then
-            DOC_VERSION="v0"
-          else
-            DOC_VERSION="v${MAJOR}.${MINOR}"
-          fi
-          if [[ -d "content/en/docs/${DOC_VERSION}" ]]; then
-            echo "promote=false" >> "$GITHUB_OUTPUT"
-            echo "content/en/docs/${DOC_VERSION}/ already exists — patch release, skipping release-next."
-          else
-            echo "promote=true" >> "$GITHUB_OUTPUT"
-            echo "New minor/major release ${DOC_VERSION} — will promote next/ → ${DOC_VERSION}/."
-          fi
-
-      - name: Promote next/ to released version
-        if: steps.promote.outputs.promote == 'true'
-        env:
-          GH_TOKEN: ${{ steps.app-token.outputs.token }}
-          TAG: ${{ steps.tag.outputs.tag }}
-        run: make release-next RELEASE_TAG="$TAG"
-
-      - name: Update docs from release branch
-        env:
-          GH_TOKEN: ${{ steps.app-token.outputs.token }}
-          TAG: ${{ steps.tag.outputs.tag }}
-          VERSION: ${{ steps.tag.outputs.version }}
-        run: make update-all BRANCH="release-$VERSION" RELEASE_TAG="$TAG"
-
-      - name: Commit and push
-        id: commit
-        run: |
-          git config user.name  "cozystack-ci[bot]"
-          git config user.email "274107086+cozystack-ci[bot]@users.noreply.github.com"
-          git add content hugo.yaml
-          if git diff --cached --quiet; then
-            echo "No changes to commit"
-            echo "changed=false" >> $GITHUB_OUTPUT
-            exit 0
-          fi
-          BRANCH="update-docs-v${{ steps.tag.outputs.version }}"
-          git branch -D "$BRANCH" 2>/dev/null || true
-          git checkout -b "$BRANCH"
-          git commit --signoff -m "[docs] Update managed apps reference for v${{ steps.tag.outputs.version }}"
-          git push --force --set-upstream origin "$BRANCH"
-          echo "changed=true" >> $GITHUB_OUTPUT
-
-      - name: Open pull request
-        if: steps.commit.outputs.changed == 'true'
-        env:
-          GH_TOKEN: ${{ steps.app-token.outputs.token }}
-        run: |
-          BRANCH="update-docs-v${{ steps.tag.outputs.version }}"
-          pr_state=$(gh pr view "$BRANCH" --repo cozystack/website --json state --jq .state 2>/dev/null || echo "")
-          if [[ "$pr_state" == "OPEN" ]]; then
-            echo "PR already open, skipping creation."
-          else
-            gh pr create \
-              --repo cozystack/website \
-              --title "[docs] Update managed apps reference for v${{ steps.tag.outputs.version }}" \
-              --body "Automated docs update for release \`v${{ steps.tag.outputs.version }}\`." \
-              --head "update-docs-v${{ steps.tag.outputs.version }}" \
-              --base main
-          fi

.gitignore

@@ -80,7 +80,3 @@ fabric.properties
 **/.DS_Store
 
 tmp/
-
-# build revision marker (generated by make image-packages)
-packages/core/platform/.build-revision
-.claude/

.pre-commit-config.yaml

@@ -1,17 +1,6 @@
 repos:
 - repo: local
   hooks:
-    - id: run-make-generate-root
-      name: Run 'make generate' at repo root
-      entry: |
-        flock -x .git/pre-commit.lock sh -c '
-          echo "Running make generate at repo root"
-          make generate || exit $?
-          git diff --color=always | cat
-        '
-      language: system
-      files: ^(api/|pkg/apis/|pkg/generated/|internal/crdinstall/manifests/|packages/system/cozystack-controller/definitions/|packages/system/application-definition-crd/definition/|packages/system/backup-controller/definitions/|packages/system/backupstrategy-controller/definitions/|hack/update-codegen\.sh$|hack/boilerplate\.go\.txt$|Makefile$)
-      pass_filenames: false
     - id: run-make-generate
       name: Run 'make generate' in all app directories
       entry: |

AGENTS.md

@@ -27,12 +27,6 @@ working with the **Cozystack** project.
   - Read: [`contributing.md`](./docs/agents/contributing.md)
   - Action: Read the file to understand git workflow, commit format, PR process
 
-- **Issue and PR labeling, triage** (e.g., "label this issue", "what label should I use", "triage this", "categorize")
-  - Read: [`.github/labels.yml`](./.github/labels.yml)
-  - Action: Use labels defined there. Conventions follow the Kubernetes scheme — `kind/*` (type), `area/*` (subsystem), `priority/*` (urgency), `triage/*` (review state), `lifecycle/*` (auto-close), `do-not-merge/*` (PR blockers), `security/*` (severity)
-  - For `area/*`: accuracy outweighs reuse. If no existing `area/*` truly fits the change, propose a new one via PR (extend `.github/labels.yml` and the scope mapping in `.github/workflows/pr-labeler.yaml`) — do not shoehorn the change into a wrong area. `area/uncategorized` is the auto-labeler fallback; treat it as a signal to pick a fit, create a new area, or correct the PR title
-  - PR titles: a Conventional Commits header (`type(scope): description`, types from [`contributing.md`](./docs/agents/contributing.md)) auto-applies `kind/*` and `area/*` via `.github/workflows/pr-labeler.yaml`. Append `!` (or add a `BREAKING CHANGE:` footer) to apply `kind/breaking-change`
-
 **Important rules:**
 - ✅ **ONLY read the file if the task matches the documented process scope** - do not read files for tasks that don't match their purpose
 - ✅ **ALWAYS read the file FIRST** before starting the task (when applicable)
@@ -59,7 +53,7 @@ working with the **Cozystack** project.
 ### Conventions
 - **Helm Charts**: Umbrella pattern, vendored upstream charts in `charts/`
 - **Go Code**: Controller-runtime patterns, kubebuilder style
-- **Git Commits**: Conventional Commits (`type(scope): description`) with `--signoff`
+- **Git Commits**: `[component] Description` format with `--signoff`
 
 ### What NOT to Do
 - ❌ Edit `/vendor/`, `zz_generated.*.go`, upstream charts directly

MAINTAINERS.md

@@ -10,5 +10,3 @@
 | Timur Tukaev | [@tym83](https://github.com/tym83) | Ænix | Cozystack Website, Marketing, Community Management |
 | Kirill Klinchenkov | [@klinch0](https://github.com/klinch0) | Ænix | Core Maintainer |
 | Nikita Bykov | [@nbykov0](https://github.com/nbykov0) | Ænix | Maintainer of ARM and stuff |
-| Matthieu Robin | [@matthieu-robin](https://github.com/matthieu-robin) | Hidora | Managed Applications, Platform Quality & Benchmarking |
-| Mattia Eleuteri | [@mattia-eleuteri](https://github.com/mattia-eleuteri) | Hidora | CSI, Storage, Networking & Security |

Makefile

@@ -1,4 +1,4 @@
-.PHONY: manifests assets unit-tests helm-unit-tests bats-unit-tests preflight
+.PHONY: manifests assets unit-tests helm-unit-tests verify-crds
 
 include hack/common-envs.mk
 
@@ -22,13 +22,11 @@ build: build-deps
 	make -C packages/system/lineage-controller-webhook image
 	make -C packages/system/cilium image
 	make -C packages/system/linstor image
-	make -C packages/system/linstor-gui image
 	make -C packages/system/kubeovn-webhook image
 	make -C packages/system/kubeovn-plunger image
 	make -C packages/system/dashboard image
 	make -C packages/system/metallb image
 	make -C packages/system/kamaji image
-	make -C packages/system/multus image
 	make -C packages/system/bucket image
 	make -C packages/system/objectstorage-controller image
 	make -C packages/system/grafana-operator image
@@ -40,31 +38,30 @@ build: build-deps
 
 manifests:
 	mkdir -p _out/assets
-	cat internal/crdinstall/manifests/*.yaml > _out/assets/cozystack-crds.yaml
+	cat packages/core/installer/crds/*.yaml > _out/assets/cozystack-crds.yaml
 	# Talos variant (default)
 	helm template installer packages/core/installer -n cozy-system \
-		--show-only templates/cozystack-operator.yaml \
+		-s templates/cozystack-operator.yaml \
+		-s templates/packagesource.yaml \
 		> _out/assets/cozystack-operator-talos.yaml
 	# Generic Kubernetes variant (k3s, kubeadm, RKE2)
 	helm template installer packages/core/installer -n cozy-system \
 		--set cozystackOperator.variant=generic \
 		--set cozystack.apiServerHost=REPLACE_ME \
-		--show-only templates/cozystack-operator.yaml \
+		-s templates/cozystack-operator.yaml \
+		-s templates/packagesource.yaml \
 		> _out/assets/cozystack-operator-generic.yaml
 	# Hosted variant (managed Kubernetes)
 	helm template installer packages/core/installer -n cozy-system \
 		--set cozystackOperator.variant=hosted \
-		--show-only templates/cozystack-operator.yaml \
+		-s templates/cozystack-operator.yaml \
+		-s templates/packagesource.yaml \
 		> _out/assets/cozystack-operator-hosted.yaml
 
 cozypkg:
 	go build -ldflags "-X github.com/cozystack/cozystack/cmd/cozypkg/cmd.Version=v$(COZYSTACK_VERSION)" -o _out/bin/cozypkg ./cmd/cozypkg
 
-assets: assets-talos assets-cozypkg openapi-json
-
-openapi-json:
-	mkdir -p _out/assets
-	VERSION=$(shell git describe --tags --always 2>/dev/null || echo dev) go run ./tools/openapi-gen/ 2>/dev/null > _out/assets/openapi.json
+assets: assets-talos assets-cozypkg
 
 assets-talos:
 	make -C packages/core/talos assets
@@ -83,46 +80,15 @@ test:
 	make -C packages/core/testing apply
 	make -C packages/core/testing test
 
-unit-tests: helm-unit-tests bats-unit-tests go-unit-tests
+verify-crds:
+	@diff --recursive packages/core/installer/crds/ internal/crdinstall/manifests/ --exclude='.*' \
+		|| (echo "ERROR: CRD manifests out of sync. Run 'make generate' to fix." && exit 1)
+
+unit-tests: helm-unit-tests verify-crds
 
 helm-unit-tests:
 	hack/helm-unit-tests.sh
 
-# Scoped go test over the cozystack-api surface that this repo owns. Kept
-# narrow intentionally - running `go test ./...` pulls in generated code
-# round-trip suites whose behavior depends on tool versions outside this
-# repo's control (kubebuilder, openapi-gen, etc.) and is better exercised
-# from their generator workflows.
-go-unit-tests:
-	go test ./pkg/registry/... ./pkg/config/... ./pkg/cmd/server/...
-
-# Discover every hack/*.bats file that is NOT an e2e test and run it
-# through cozytest.sh. Drop a new *.bats file in hack/ and it is picked
-# up automatically on the next `make unit-tests` run.
-#
-# Caveat: $(wildcard ...) returns space-separated names, so a filename
-# containing a literal space would split into multiple tokens here. All
-# current bats files use hyphen-separated names; if the project ever
-# introduces whitespace-bearing filenames this recipe must be rewritten
-# (e.g. to use `find ... -print0 | xargs -0`).
-BATS_UNIT_FILES := $(filter-out hack/e2e-%.bats,$(wildcard hack/*.bats))
-
-bats-unit-tests:
-	@if [ -z "$(BATS_UNIT_FILES)" ]; then \
-		echo "ERROR: no hack/*.bats unit test files found"; \
-		exit 1; \
-	fi
-	@for f in $(BATS_UNIT_FILES); do \
-		echo "--- running $$f ---"; \
-		hack/cozytest.sh "$$f" || exit 1; \
-	done
-
-# Operator-facing host preflight check. Warns about a standalone
-# containerd.service or docker.service running alongside the embedded
-# k3s runtime. Safe to run at any time; always exits 0.
-preflight:
-	@hack/check-host-runtime.sh
-
 prepare-env:
 	make -C packages/core/testing apply
 	make -C packages/core/testing prepare-cluster

README.md

@@ -6,12 +6,11 @@
 [![Support](https://img.shields.io/badge/$-support-12a0df.svg?style=flat)](https://cozystack.io/support/)
 [![Active](http://img.shields.io/badge/Status-Active-green.svg)](https://github.com/cozystack/cozystack)
 [![GitHub Release](https://img.shields.io/github/release/cozystack/cozystack.svg?style=flat)](https://github.com/cozystack/cozystack/releases/latest)
-[![GitHub Commit](https://img.shields.io/github/commit-activity/y/cozystack/cozystack)](https://github.com/cozystack/cozystack/graphs/contributors)
-[![OpenSSF Best Practices](https://www.bestpractices.dev/projects/10177/badge)](https://www.bestpractices.dev/projects/10177)
+[![GitHub Commit](https://img.shields.io/github/commit-activity/y/cozystack/cozystack)](https://github.com/cozystack/cozystack/graphs/contributors) 
 
 # Cozystack
 
-**Cozystack** is a free platform and framework for building clouds.
+**Cozystack** is a free PaaS platform and framework for building clouds.
 
 Cozystack is a [CNCF Sandbox Level Project](https://www.cncf.io/sandbox-projects/) that was originally built and sponsored by [Ænix](https://aenix.io/).
 

SECURITY.md

@@ -1,102 +0,0 @@
-# Security Policy
-
-## Scope
-
-This policy applies to the [`cozystack/cozystack`](https://github.com/cozystack/cozystack) repository and to release artifacts produced from it, including Cozystack core components, operators, packaged manifests, container images, and installation assets published by the project.
-
-Cozystack integrates and ships many upstream cloud native components. If you believe a vulnerability originates in an upstream project rather than in Cozystack-specific code, packaging, defaults, or integration logic, please report it to the upstream project as well. If you are unsure, report it to Cozystack first and we will help route or coordinate the issue.
-
-## Supported Versions
-
-As of March 17, 2026, the Cozystack project maintains multiple release lines. Security fixes are prioritized for the latest stable release line and, when needed, backported to other supported lines.
-
-| Version line | Status | Notes |
-| --- | --- | --- |
-| `v1.1.x` | Supported | Current stable release line. |
-| `v1.0.x` | Supported | Previous stable release line; receives security and important maintenance fixes. |
-| `v0.41.x` | Limited support | Legacy pre-v1 line during the v0 to v1 transition; critical security and upgrade-blocking fixes may be backported at maintainer discretion. |
-| `< v0.41` | Not supported | Please upgrade to a supported release line before requesting a security fix. |
-| `alpha`, `beta`, `rc` releases | Not supported | Pre-release builds are for testing and evaluation only. |
-
-Supported versions may change over time as new release lines are cut. The authoritative source for current releases is the GitHub Releases page:
-
-<https://github.com/cozystack/cozystack/releases>
-
-## Reporting a Vulnerability
-
-Please do **not** report security vulnerabilities through public GitHub issues, discussions, pull requests, Telegram, Slack, or other public community channels.
-
-At the moment, this repository does not publish a dedicated private security mailbox in-tree. If you need to report a vulnerability:
-
-1. Contact one of the project maintainers listed in `CODEOWNERS` using an existing private channel you already have.
-2. If you do not already have a private maintainer contact, use a public community channel only to request a private contact path, without disclosing any vulnerability details.
-
-Please do not include exploit details, credentials, tokens, private keys, customer data, or other sensitive material in any public message.
-
-When reporting a vulnerability, please include as much of the following as possible:
-
-- affected Cozystack version, tag, or commit
-- affected component or package, for example operator, API server, dashboard, installer, or a packaged system component
-- deployment environment and provider, for example bare metal, Hetzner, Oracle Cloud, or other infrastructure
-- prerequisites and exact reproduction steps
-- impact, attack scenario, and expected blast radius
-- whether authentication, tenant access, cluster-admin access, or network adjacency is required
-- known mitigations or workarounds
-- whether you believe the issue also affects an upstream dependency
-
-## What to Expect
-
-The maintainers will aim to:
-
-- acknowledge receipt within 3 business days
-- perform an initial triage and severity assessment within 7 business days
-- keep the reporter informed as the fix and disclosure plan are developed
-
-Resolution timelines depend on severity, complexity, release branch applicability, and whether coordination with upstream projects is required.
-
-## Disclosure Process
-
-The Cozystack project follows a coordinated disclosure model.
-
-- We ask reporters to keep details private until a fix or mitigation is available and users have had a reasonable opportunity to upgrade.
-- When appropriate, maintainers may use GitHub Security Advisories or equivalent coordinated disclosure tooling to manage remediation and public disclosure.
-- If appropriate, the project may request or publish a GHSA and/or CVE as part of the disclosure process.
-- Fixes will normally be released in the supported version lines affected by the issue, subject to severity and feasibility.
-
-Public disclosure will typically happen through one or more of the following:
-
-- GitHub Releases and release notes
-- project changelogs and documentation updates
-- GitHub Security Advisories, when used for coordinated disclosure
-
-## Project Security Practices
-
-Security is part of the normal Cozystack development and release process. Current project practices include:
-
-- maintainer-owned review through pull requests and `CODEOWNERS`
-- automated pull request checks, including pre-commit validation, unit tests, builds, and end-to-end testing
-- release automation with patch releases, release branches, and backport workflows
-- ongoing maintenance of packaged dependencies and platform integrations across supported release lines
-
-Because Cozystack is an integration-heavy platform, some vulnerabilities may require coordination across multiple repositories or with upstream maintainers before a public fix can be released.
-
-## Security Fixes and Announcements
-
-Security fixes are published in normal release artifacts whenever possible. Users should monitor:
-
-- GitHub Releases: <https://github.com/cozystack/cozystack/releases>
-- project changelogs in this repository
-- the Cozystack website and documentation: <https://cozystack.io>
-
-## Out of Scope
-
-The following are generally out of scope for private security reporting unless there is a clear Cozystack-specific impact:
-
-- vulnerabilities in unsupported or end-of-life Cozystack versions
-- issues that require access already equivalent to cluster-admin, node root, or direct infrastructure administrator privileges, unless they bypass an expected Cozystack security boundary
-- vulnerabilities that exist only in an upstream dependency and are not introduced or materially worsened by Cozystack packaging, configuration, or defaults
-- requests for security best-practice advice without a concrete vulnerability
-
-## Credits
-
-We appreciate responsible disclosure and will credit reporters in public advisories or release notes unless anonymous disclosure is requested.

api/apps/v1alpha1/bucket/types.go

@@ -1,33 +0,0 @@
-// Code generated by values-gen. DO NOT EDIT.
-// +kubebuilder:object:generate=true
-// +groupName=apps.cozystack.io
-// +versionName=v1alpha1
-package bucket
-
-import (
-	"k8s.io/apimachinery/pkg/apis/meta/v1"
-)
-
-// +kubebuilder:object:root=true
-type Config struct {
-	v1.TypeMeta   `json:",inline"`
-	v1.ObjectMeta `json:"metadata,omitempty"`
-	Spec          ConfigSpec `json:"spec,omitempty"`
-}
-
-type ConfigSpec struct {
-	// Provisions bucket from the `-lock` BucketClass (with object lock enabled).
-	// +kubebuilder:default:=false
-	Locking bool `json:"locking"`
-	// Selects a specific BucketClass by storage pool name.
-	// +kubebuilder:default:=""
-	StoragePool string `json:"storagePool,omitempty"`
-	// Users configuration map.
-	// +kubebuilder:default:={}
-	Users map[string]User `json:"users,omitempty"`
-}
-
-type User struct {
-	// Whether the user has read-only access.
-	Readonly bool `json:"readonly,omitempty"`
-}

api/apps/v1alpha1/bucket/zz_generated.deepcopy.go

@@ -1,88 +0,0 @@
-//go:build !ignore_autogenerated
-
-/*
-Copyright 2025 The Cozystack Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-// Code generated by controller-gen. DO NOT EDIT.
-
-package bucket
-
-import (
-	runtime "k8s.io/apimachinery/pkg/runtime"
-)
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *Config) DeepCopyInto(out *Config) {
-	*out = *in
-	out.TypeMeta = in.TypeMeta
-	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
-	in.Spec.DeepCopyInto(&out.Spec)
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Config.
-func (in *Config) DeepCopy() *Config {
-	if in == nil {
-		return nil
-	}
-	out := new(Config)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
-func (in *Config) DeepCopyObject() runtime.Object {
-	if c := in.DeepCopy(); c != nil {
-		return c
-	}
-	return nil
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *ConfigSpec) DeepCopyInto(out *ConfigSpec) {
-	*out = *in
-	if in.Users != nil {
-		in, out := &in.Users, &out.Users
-		*out = make(map[string]User, len(*in))
-		for key, val := range *in {
-			(*out)[key] = val
-		}
-	}
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ConfigSpec.
-func (in *ConfigSpec) DeepCopy() *ConfigSpec {
-	if in == nil {
-		return nil
-	}
-	out := new(ConfigSpec)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *User) DeepCopyInto(out *User) {
-	*out = *in
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new User.
-func (in *User) DeepCopy() *User {
-	if in == nil {
-		return nil
-	}
-	out := new(User)
-	in.DeepCopyInto(out)
-	return out
-}

api/apps/v1alpha1/clickhouse/types.go

@@ -1,112 +0,0 @@
-// Code generated by values-gen. DO NOT EDIT.
-// +kubebuilder:object:generate=true
-// +groupName=apps.cozystack.io
-// +versionName=v1alpha1
-package clickhouse
-
-import (
-	resource "k8s.io/apimachinery/pkg/api/resource"
-	"k8s.io/apimachinery/pkg/apis/meta/v1"
-)
-
-// +kubebuilder:object:root=true
-type Config struct {
-	v1.TypeMeta   `json:",inline"`
-	v1.ObjectMeta `json:"metadata,omitempty"`
-	Spec          ConfigSpec `json:"spec,omitempty"`
-}
-
-type ConfigSpec struct {
-	// Number of ClickHouse replicas.
-	// +kubebuilder:default:=2
-	Replicas int `json:"replicas"`
-	// Number of ClickHouse shards.
-	// +kubebuilder:default:=1
-	Shards int `json:"shards"`
-	// Explicit CPU and memory configuration for each ClickHouse replica. When omitted, the preset defined in `resourcesPreset` is applied.
-	// +kubebuilder:default:={}
-	Resources Resources `json:"resources,omitempty"`
-	// Default sizing preset used when `resources` is omitted.
-	// +kubebuilder:default:="small"
-	ResourcesPreset ResourcesPreset `json:"resourcesPreset"`
-	// Persistent Volume Claim size available for application data.
-	// +kubebuilder:default:="10Gi"
-	Size resource.Quantity `json:"size"`
-	// StorageClass used to store the data.
-	// +kubebuilder:default:=""
-	StorageClass string `json:"storageClass"`
-	// Size of Persistent Volume for logs.
-	// +kubebuilder:default:="2Gi"
-	LogStorageSize resource.Quantity `json:"logStorageSize"`
-	// TTL (expiration time) for `query_log` and `query_thread_log`.
-	// +kubebuilder:default:=15
-	LogTTL int `json:"logTTL"`
-	// Users configuration map.
-	// +kubebuilder:default:={}
-	Users map[string]User `json:"users,omitempty"`
-	// Backup configuration.
-	// +kubebuilder:default:={}
-	Backup Backup `json:"backup"`
-	// ClickHouse Keeper configuration.
-	// +kubebuilder:default:={}
-	ClickhouseKeeper ClickHouseKeeper `json:"clickhouseKeeper"`
-}
-
-type Backup struct {
-	// Retention strategy for cleaning up old backups.
-	// +kubebuilder:default:="--keep-last=3 --keep-daily=3 --keep-within-weekly=1m"
-	CleanupStrategy string `json:"cleanupStrategy"`
-	// Enable regular backups (default: false).
-	// +kubebuilder:default:=false
-	Enabled bool `json:"enabled"`
-	// Password for Restic backup encryption.
-	// +kubebuilder:default:="<password>"
-	ResticPassword string `json:"resticPassword"`
-	// Access key for S3 authentication.
-	// +kubebuilder:default:="<your-access-key>"
-	S3AccessKey string `json:"s3AccessKey"`
-	// S3 bucket used for storing backups.
-	// +kubebuilder:default:="s3.example.org/clickhouse-backups"
-	S3Bucket string `json:"s3Bucket"`
-	// AWS S3 region where backups are stored.
-	// +kubebuilder:default:="us-east-1"
-	S3Region string `json:"s3Region"`
-	// Secret key for S3 authentication.
-	// +kubebuilder:default:="<your-secret-key>"
-	S3SecretKey string `json:"s3SecretKey"`
-	// Cron schedule for automated backups.
-	// +kubebuilder:default:="0 2 * * *"
-	Schedule string `json:"schedule"`
-}
-
-type ClickHouseKeeper struct {
-	// Deploy ClickHouse Keeper for cluster coordination.
-	// +kubebuilder:default:=true
-	Enabled bool `json:"enabled,omitempty"`
-	// Number of Keeper replicas.
-	// +kubebuilder:default:=3
-	Replicas int `json:"replicas,omitempty"`
-	// Default sizing preset.
-	// +kubebuilder:default:="micro"
-	ResourcesPreset ResourcesPreset `json:"resourcesPreset,omitempty"`
-	// Persistent Volume Claim size available for application data.
-	// +kubebuilder:default:="1Gi"
-	Size resource.Quantity `json:"size,omitempty"`
-}
-
-type Resources struct {
-	// CPU available to each replica.
-	Cpu resource.Quantity `json:"cpu,omitempty"`
-	// Memory (RAM) available to each replica.
-	Memory resource.Quantity `json:"memory,omitempty"`
-}
-
-type User struct {
-	// Password for the user.
-	Password string `json:"password,omitempty"`
-	// User is readonly (default: false).
-	Readonly bool `json:"readonly,omitempty"`
-}
-
-// +kubebuilder:validation:Enum="nano";"micro";"small";"medium";"large";"xlarge";"2xlarge"
-type ResourcesPreset string

api/apps/v1alpha1/clickhouse/zz_generated.deepcopy.go

@@ -1,141 +0,0 @@
-//go:build !ignore_autogenerated
-
-/*
-Copyright 2025 The Cozystack Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-// Code generated by controller-gen. DO NOT EDIT.
-
-package clickhouse
-
-import (
-	runtime "k8s.io/apimachinery/pkg/runtime"
-)
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *Backup) DeepCopyInto(out *Backup) {
-	*out = *in
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Backup.
-func (in *Backup) DeepCopy() *Backup {
-	if in == nil {
-		return nil
-	}
-	out := new(Backup)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *ClickHouseKeeper) DeepCopyInto(out *ClickHouseKeeper) {
-	*out = *in
-	out.Size = in.Size.DeepCopy()
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ClickHouseKeeper.
-func (in *ClickHouseKeeper) DeepCopy() *ClickHouseKeeper {
-	if in == nil {
-		return nil
-	}
-	out := new(ClickHouseKeeper)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *Config) DeepCopyInto(out *Config) {
-	*out = *in
-	out.TypeMeta = in.TypeMeta
-	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
-	in.Spec.DeepCopyInto(&out.Spec)
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Config.
-func (in *Config) DeepCopy() *Config {
-	if in == nil {
-		return nil
-	}
-	out := new(Config)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
-func (in *Config) DeepCopyObject() runtime.Object {
-	if c := in.DeepCopy(); c != nil {
-		return c
-	}
-	return nil
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *ConfigSpec) DeepCopyInto(out *ConfigSpec) {
-	*out = *in
-	in.Resources.DeepCopyInto(&out.Resources)
-	out.Size = in.Size.DeepCopy()
-	out.LogStorageSize = in.LogStorageSize.DeepCopy()
-	if in.Users != nil {
-		in, out := &in.Users, &out.Users
-		*out = make(map[string]User, len(*in))
-		for key, val := range *in {
-			(*out)[key] = val
-		}
-	}
-	out.Backup = in.Backup
-	in.ClickhouseKeeper.DeepCopyInto(&out.ClickhouseKeeper)
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ConfigSpec.
-func (in *ConfigSpec) DeepCopy() *ConfigSpec {
-	if in == nil {
-		return nil
-	}
-	out := new(ConfigSpec)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *Resources) DeepCopyInto(out *Resources) {
-	*out = *in
-	out.Cpu = in.Cpu.DeepCopy()
-	out.Memory = in.Memory.DeepCopy()
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Resources.
-func (in *Resources) DeepCopy() *Resources {
-	if in == nil {
-		return nil
-	}
-	out := new(Resources)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *User) DeepCopyInto(out *User) {
-	*out = *in
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new User.
-func (in *User) DeepCopy() *User {
-	if in == nil {
-		return nil
-	}
-	out := new(User)
-	in.DeepCopyInto(out)
-	return out
-}

api/apps/v1alpha1/foundationdb/types.go

@@ -1,162 +0,0 @@
-// Code generated by values-gen. DO NOT EDIT.
-// +kubebuilder:object:generate=true
-// +groupName=apps.cozystack.io
-// +versionName=v1alpha1
-package foundationdb
-
-import (
-	resource "k8s.io/apimachinery/pkg/api/resource"
-	"k8s.io/apimachinery/pkg/apis/meta/v1"
-)
-
-// +kubebuilder:object:root=true
-type Config struct {
-	v1.TypeMeta   `json:",inline"`
-	v1.ObjectMeta `json:"metadata,omitempty"`
-	Spec          ConfigSpec `json:"spec,omitempty"`
-}
-
-type ConfigSpec struct {
-	// Cluster configuration.
-	// +kubebuilder:default:={}
-	Cluster Cluster `json:"cluster"`
-	// Storage configuration.
-	// +kubebuilder:default:={}
-	Storage Storage `json:"storage"`
-	// Explicit CPU and memory configuration for each FoundationDB instance. When omitted, the preset defined in `resourcesPreset` is applied.
-	// +kubebuilder:default:={}
-	Resources Resources `json:"resources,omitempty"`
-	// Default sizing preset used when `resources` is omitted.
-	// +kubebuilder:default:="medium"
-	ResourcesPreset ResourcesPreset `json:"resourcesPreset"`
-	// Backup configuration.
-	// +kubebuilder:default:={}
-	Backup Backup `json:"backup"`
-	// Monitoring configuration.
-	// +kubebuilder:default:={}
-	Monitoring Monitoring `json:"monitoring"`
-	// Custom parameters to pass to FoundationDB.
-	// +kubebuilder:default:={}
-	CustomParameters []string `json:"customParameters,omitempty"`
-	// Container image deployment type.
-	// +kubebuilder:default:="unified"
-	ImageType ImageType `json:"imageType"`
-	// Security context for containers.
-	// +kubebuilder:default:={}
-	SecurityContext SecurityContext `json:"securityContext"`
-	// Enable automatic pod replacements.
-	// +kubebuilder:default:=true
-	AutomaticReplacements bool `json:"automaticReplacements"`
-}
-
-type Backup struct {
-	// Enable backups.
-	// +kubebuilder:default:=false
-	Enabled bool `json:"enabled"`
-	// Retention policy for backups.
-	// +kubebuilder:default:="7d"
-	RetentionPolicy string `json:"retentionPolicy"`
-	// S3 configuration for backups.
-	// +kubebuilder:default:={}
-	S3 BackupS3 `json:"s3"`
-}
-
-type BackupS3 struct {
-	// S3 bucket name.
-	// +kubebuilder:default:=""
-	Bucket string `json:"bucket"`
-	// S3 credentials.
-	// +kubebuilder:default:={}
-	Credentials BackupS3Credentials `json:"credentials"`
-	// S3 endpoint URL.
-	// +kubebuilder:default:=""
-	Endpoint string `json:"endpoint"`
-	// S3 region.
-	// +kubebuilder:default:="us-east-1"
-	Region string `json:"region"`
-}
-
-type BackupS3Credentials struct {
-	// S3 access key ID.
-	// +kubebuilder:default:=""
-	AccessKeyId string `json:"accessKeyId"`
-	// S3 secret access key.
-	// +kubebuilder:default:=""
-	SecretAccessKey string `json:"secretAccessKey"`
-}
-
-type Cluster struct {
-	// Fault domain configuration.
-	// +kubebuilder:default:={}
-	FaultDomain ClusterFaultDomain `json:"faultDomain"`
-	// Process counts for different roles.
-	// +kubebuilder:default:={}
-	ProcessCounts ClusterProcessCounts `json:"processCounts"`
-	// Database redundancy mode (single, double, triple, three_datacenter, three_datacenter_fallback).
-	// +kubebuilder:default:="double"
-	RedundancyMode string `json:"redundancyMode"`
-	// Storage engine (ssd-2, ssd-redwood-v1, ssd-rocksdb-v1, memory).
-	// +kubebuilder:default:="ssd-2"
-	StorageEngine string `json:"storageEngine"`
-	// Version of FoundationDB to use.
-	// +kubebuilder:default:="7.3.63"
-	Version string `json:"version"`
-}
-
-type ClusterFaultDomain struct {
-	// Fault domain key.
-	// +kubebuilder:default:="kubernetes.io/hostname"
-	Key string `json:"key"`
-	// Fault domain value source.
-	// +kubebuilder:default:="spec.nodeName"
-	ValueFrom string `json:"valueFrom"`
-}
-
-type ClusterProcessCounts struct {
-	// Number of cluster controller processes.
-	// +kubebuilder:default:=1
-	ClusterController int `json:"cluster_controller"`
-	// Number of stateless processes (-1 for automatic).
-	// +kubebuilder:default:=-1
-	Stateless int `json:"stateless"`
-	// Number of storage processes (determines cluster size).
-	// +kubebuilder:default:=3
-	Storage int `json:"storage"`
-}
-
-type Monitoring struct {
-	// Enable WorkloadMonitor integration.
-	// +kubebuilder:default:=true
-	Enabled bool `json:"enabled"`
-}
-
-type Resources struct {
-	// CPU available to each instance.
-	Cpu resource.Quantity `json:"cpu,omitempty"`
-	// Memory (RAM) available to each instance.
-	Memory resource.Quantity `json:"memory,omitempty"`
-}
-
-type SecurityContext struct {
-	// Group ID to run the container.
-	// +kubebuilder:default:=4059
-	RunAsGroup int `json:"runAsGroup"`
-	// User ID to run the container.
-	// +kubebuilder:default:=4059
-	RunAsUser int `json:"runAsUser"`
-}
-
-type Storage struct {
-	// Size of persistent volumes for each instance.
-	// +kubebuilder:default:="16Gi"
-	Size resource.Quantity `json:"size"`
-	// Storage class (if not set, uses cluster default).
-	// +kubebuilder:default:=""
-	StorageClass string `json:"storageClass"`
-}
-
-// +kubebuilder:validation:Enum="unified";"split"
-type ImageType string
-
-// +kubebuilder:validation:Enum="small";"medium";"large";"xlarge";"2xlarge"
-type ResourcesPreset string

api/apps/v1alpha1/foundationdb/zz_generated.deepcopy.go

@@ -1,234 +0,0 @@
-//go:build !ignore_autogenerated
-
-/*
-Copyright 2025 The Cozystack Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-// Code generated by controller-gen. DO NOT EDIT.
-
-package foundationdb
-
-import (
-	runtime "k8s.io/apimachinery/pkg/runtime"
-)
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *Backup) DeepCopyInto(out *Backup) {
-	*out = *in
-	out.S3 = in.S3
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Backup.
-func (in *Backup) DeepCopy() *Backup {
-	if in == nil {
-		return nil
-	}
-	out := new(Backup)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *BackupS3) DeepCopyInto(out *BackupS3) {
-	*out = *in
-	out.Credentials = in.Credentials
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new BackupS3.
-func (in *BackupS3) DeepCopy() *BackupS3 {
-	if in == nil {
-		return nil
-	}
-	out := new(BackupS3)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *BackupS3Credentials) DeepCopyInto(out *BackupS3Credentials) {
-	*out = *in
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new BackupS3Credentials.
-func (in *BackupS3Credentials) DeepCopy() *BackupS3Credentials {
-	if in == nil {
-		return nil
-	}
-	out := new(BackupS3Credentials)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *Cluster) DeepCopyInto(out *Cluster) {
-	*out = *in
-	out.FaultDomain = in.FaultDomain
-	out.ProcessCounts = in.ProcessCounts
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Cluster.
-func (in *Cluster) DeepCopy() *Cluster {
-	if in == nil {
-		return nil
-	}
-	out := new(Cluster)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *ClusterFaultDomain) DeepCopyInto(out *ClusterFaultDomain) {
-	*out = *in
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ClusterFaultDomain.
-func (in *ClusterFaultDomain) DeepCopy() *ClusterFaultDomain {
-	if in == nil {
-		return nil
-	}
-	out := new(ClusterFaultDomain)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *ClusterProcessCounts) DeepCopyInto(out *ClusterProcessCounts) {
-	*out = *in
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ClusterProcessCounts.
-func (in *ClusterProcessCounts) DeepCopy() *ClusterProcessCounts {
-	if in == nil {
-		return nil
-	}
-	out := new(ClusterProcessCounts)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *Config) DeepCopyInto(out *Config) {
-	*out = *in
-	out.TypeMeta = in.TypeMeta
-	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
-	in.Spec.DeepCopyInto(&out.Spec)
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Config.
-func (in *Config) DeepCopy() *Config {
-	if in == nil {
-		return nil
-	}
-	out := new(Config)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
-func (in *Config) DeepCopyObject() runtime.Object {
-	if c := in.DeepCopy(); c != nil {
-		return c
-	}
-	return nil
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *ConfigSpec) DeepCopyInto(out *ConfigSpec) {
-	*out = *in
-	out.Cluster = in.Cluster
-	in.Storage.DeepCopyInto(&out.Storage)
-	in.Resources.DeepCopyInto(&out.Resources)
-	out.Backup = in.Backup
-	out.Monitoring = in.Monitoring
-	if in.CustomParameters != nil {
-		in, out := &in.CustomParameters, &out.CustomParameters
-		*out = make([]string, len(*in))
-		copy(*out, *in)
-	}
-	out.SecurityContext = in.SecurityContext
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ConfigSpec.
-func (in *ConfigSpec) DeepCopy() *ConfigSpec {
-	if in == nil {
-		return nil
-	}
-	out := new(ConfigSpec)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *Monitoring) DeepCopyInto(out *Monitoring) {
-	*out = *in
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Monitoring.
-func (in *Monitoring) DeepCopy() *Monitoring {
-	if in == nil {
-		return nil
-	}
-	out := new(Monitoring)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *Resources) DeepCopyInto(out *Resources) {
-	*out = *in
-	out.Cpu = in.Cpu.DeepCopy()
-	out.Memory = in.Memory.DeepCopy()
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Resources.
-func (in *Resources) DeepCopy() *Resources {
-	if in == nil {
-		return nil
-	}
-	out := new(Resources)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *SecurityContext) DeepCopyInto(out *SecurityContext) {
-	*out = *in
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SecurityContext.
-func (in *SecurityContext) DeepCopy() *SecurityContext {
-	if in == nil {
-		return nil
-	}
-	out := new(SecurityContext)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *Storage) DeepCopyInto(out *Storage) {
-	*out = *in
-	out.Size = in.Size.DeepCopy()
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Storage.
-func (in *Storage) DeepCopy() *Storage {
-	if in == nil {
-		return nil
-	}
-	out := new(Storage)
-	in.DeepCopyInto(out)
-	return out
-}

api/apps/v1alpha1/go.mod

@@ -1,24 +0,0 @@
-module github.com/cozystack/cozystack/api/apps/v1alpha1
-
-go 1.25.0
-
-require k8s.io/apimachinery v0.35.2
-
-require (
-	github.com/fxamacker/cbor/v2 v2.9.0 // indirect
-	github.com/go-logr/logr v1.4.3 // indirect
-	github.com/json-iterator/go v1.1.12 // indirect
-	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
-	github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect
-	github.com/x448/float16 v0.8.4 // indirect
-	go.yaml.in/yaml/v2 v2.4.3 // indirect
-	golang.org/x/net v0.47.0 // indirect
-	golang.org/x/text v0.31.0 // indirect
-	gopkg.in/inf.v0 v0.9.1 // indirect
-	k8s.io/klog/v2 v2.130.1 // indirect
-	k8s.io/kube-openapi v0.0.0-20250910181357-589584f1c912 // indirect
-	k8s.io/utils v0.0.0-20251002143259-bc988d571ff4 // indirect
-	sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 // indirect
-	sigs.k8s.io/randfill v1.0.0 // indirect
-	sigs.k8s.io/structured-merge-diff/v6 v6.3.0 // indirect
-)

api/apps/v1alpha1/go.sum

@@ -1,56 +0,0 @@
-github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
-github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/fxamacker/cbor/v2 v2.9.0 h1:NpKPmjDBgUfBms6tr6JZkTHtfFGcMKsw3eGcmD/sapM=
-github.com/fxamacker/cbor/v2 v2.9.0/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ=
-github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
-github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
-github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
-github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
-github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
-github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
-github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
-github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
-github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=
-github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
-github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
-github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee h1:W5t00kpgFdJifH4BDsTlE89Zl93FEloxaWZfGcifgq8=
-github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
-github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
-github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/spf13/pflag v1.0.9 h1:9exaQaMOCwffKiiiYk6/BndUBv+iRViNW+4lEMi0PvY=
-github.com/spf13/pflag v1.0.9/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
-github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
-github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
-github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
-github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
-github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
-github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg=
-go.yaml.in/yaml/v2 v2.4.3 h1:6gvOSjQoTB3vt1l+CU+tSyi/HOjfOjRLJ4YwYZGwRO0=
-go.yaml.in/yaml/v2 v2.4.3/go.mod h1:zSxWcmIDjOzPXpjlTTbAsKokqkDNAVtZO0WOMiT90s8=
-golang.org/x/net v0.47.0 h1:Mx+4dIFzqraBXUugkia1OOvlD6LemFo1ALMHjrXDOhY=
-golang.org/x/net v0.47.0/go.mod h1:/jNxtkgq5yWUGYkaZGqo27cfGZ1c5Nen03aYrrKpVRU=
-golang.org/x/text v0.31.0 h1:aC8ghyu4JhP8VojJ2lEHBnochRno1sgL6nEi9WGFGMM=
-golang.org/x/text v0.31.0/go.mod h1:tKRAlv61yKIjGGHX/4tP1LTbc13YSec1pxVEWXzfoeM=
-gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
-gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc=
-gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
-gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
-gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-k8s.io/apimachinery v0.35.2 h1:NqsM/mmZA7sHW02JZ9RTtk3wInRgbVxL8MPfzSANAK8=
-k8s.io/apimachinery v0.35.2/go.mod h1:jQCgFZFR1F4Ik7hvr2g84RTJSZegBc8yHgFWKn//hns=
-k8s.io/klog/v2 v2.130.1 h1:n9Xl7H1Xvksem4KFG4PYbdQCQxqc/tTUyrgXaOhHSzk=
-k8s.io/klog/v2 v2.130.1/go.mod h1:3Jpz1GvMt720eyJH1ckRHK1EDfpxISzJ7I9OYgaDtPE=
-k8s.io/kube-openapi v0.0.0-20250910181357-589584f1c912 h1:Y3gxNAuB0OBLImH611+UDZcmKS3g6CthxToOb37KgwE=
-k8s.io/kube-openapi v0.0.0-20250910181357-589584f1c912/go.mod h1:kdmbQkyfwUagLfXIad1y2TdrjPFWp2Q89B3qkRwf/pQ=
-k8s.io/utils v0.0.0-20251002143259-bc988d571ff4 h1:SjGebBtkBqHFOli+05xYbK8YF1Dzkbzn+gDM4X9T4Ck=
-k8s.io/utils v0.0.0-20251002143259-bc988d571ff4/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
-sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 h1:IpInykpT6ceI+QxKBbEflcR5EXP7sU1kvOlxwZh5txg=
-sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730/go.mod h1:mdzfpAEoE6DHQEN0uh9ZbOCuHbLK5wOm7dK4ctXE9Tg=
-sigs.k8s.io/randfill v1.0.0 h1:JfjMILfT8A6RbawdsK2JXGBR5AQVfd+9TbzrlneTyrU=
-sigs.k8s.io/randfill v1.0.0/go.mod h1:XeLlZ/jmk4i1HRopwe7/aU3H5n1zNUcX6TM94b3QxOY=
-sigs.k8s.io/structured-merge-diff/v6 v6.3.0 h1:jTijUJbW353oVOd9oTlifJqOGEkUw2jB/fXCbTiQEco=
-sigs.k8s.io/structured-merge-diff/v6 v6.3.0/go.mod h1:M3W8sfWvn2HhQDIbGWj3S099YozAsymCo/wrT5ohRUE=
-sigs.k8s.io/yaml v1.6.0 h1:G8fkbMSAFqgEFgh4b1wmtzDnioxFCUgTZhlbj5P9QYs=
-sigs.k8s.io/yaml v1.6.0/go.mod h1:796bPqUfzR/0jLAl6XjHl3Ck7MiyVv8dbTdyT3/pMf4=

api/apps/v1alpha1/harbor/types.go

@@ -1,114 +0,0 @@
-// Code generated by values-gen. DO NOT EDIT.
-// +kubebuilder:object:generate=true
-// +groupName=apps.cozystack.io
-// +versionName=v1alpha1
-package harbor
-
-import (
-	resource "k8s.io/apimachinery/pkg/api/resource"
-	"k8s.io/apimachinery/pkg/apis/meta/v1"
-)
-
-// +kubebuilder:object:root=true
-type Config struct {
-	v1.TypeMeta   `json:",inline"`
-	v1.ObjectMeta `json:"metadata,omitempty"`
-	Spec          ConfigSpec `json:"spec,omitempty"`
-}
-
-type ConfigSpec struct {
-	// Hostname for external access to Harbor (defaults to 'harbor' subdomain for the tenant host).
-	// +kubebuilder:default:=""
-	Host string `json:"host,omitempty"`
-	// StorageClass used to store the data.
-	// +kubebuilder:default:=""
-	StorageClass string `json:"storageClass"`
-	// Core API server configuration.
-	// +kubebuilder:default:={}
-	Core Core `json:"core"`
-	// Container image registry configuration.
-	// +kubebuilder:default:={}
-	Registry Registry `json:"registry"`
-	// Background job service configuration.
-	// +kubebuilder:default:={}
-	Jobservice Jobservice `json:"jobservice"`
-	// Trivy vulnerability scanner configuration.
-	// +kubebuilder:default:={}
-	Trivy Trivy `json:"trivy"`
-	// PostgreSQL database configuration.
-	// +kubebuilder:default:={}
-	Database Database `json:"database"`
-	// Redis cache configuration.
-	// +kubebuilder:default:={}
-	Redis Redis `json:"redis"`
-}
-
-type Core struct {
-	// Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.
-	// +kubebuilder:default:={}
-	Resources Resources `json:"resources,omitempty"`
-	// Default sizing preset used when `resources` is omitted.
-	// +kubebuilder:default:="small"
-	ResourcesPreset ResourcesPreset `json:"resourcesPreset,omitempty"`
-}
-
-type Database struct {
-	// Number of database instances.
-	// +kubebuilder:default:=2
-	Replicas int `json:"replicas"`
-	// Persistent Volume size for database storage.
-	// +kubebuilder:default:="5Gi"
-	Size resource.Quantity `json:"size"`
-}
-
-type Jobservice struct {
-	// Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.
-	// +kubebuilder:default:={}
-	Resources Resources `json:"resources,omitempty"`
-	// Default sizing preset used when `resources` is omitted.
-	// +kubebuilder:default:="nano"
-	ResourcesPreset ResourcesPreset `json:"resourcesPreset,omitempty"`
-}
-
-type Redis struct {
-	// Number of Redis replicas.
-	// +kubebuilder:default:=2
-	Replicas int `json:"replicas"`
-	// Persistent Volume size for cache storage.
-	// +kubebuilder:default:="1Gi"
-	Size resource.Quantity `json:"size"`
-}
-
-type Registry struct {
-	// Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.
-	// +kubebuilder:default:={}
-	Resources Resources `json:"resources,omitempty"`
-	// Default sizing preset used when `resources` is omitted.
-	// +kubebuilder:default:="small"
-	ResourcesPreset ResourcesPreset `json:"resourcesPreset,omitempty"`
-}
-
-type Resources struct {
-	// Number of CPU cores allocated.
-	Cpu resource.Quantity `json:"cpu,omitempty"`
-	// Amount of memory allocated.
-	Memory resource.Quantity `json:"memory,omitempty"`
-}
-
-type Trivy struct {
-	// Enable or disable the vulnerability scanner.
-	// +kubebuilder:default:=true
-	Enabled bool `json:"enabled"`
-	// Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.
-	// +kubebuilder:default:={}
-	Resources Resources `json:"resources,omitempty"`
-	// Default sizing preset used when `resources` is omitted.
-	// +kubebuilder:default:="nano"
-	ResourcesPreset ResourcesPreset `json:"resourcesPreset,omitempty"`
-	// Persistent Volume size for vulnerability database cache.
-	// +kubebuilder:default:="5Gi"
-	Size resource.Quantity `json:"size"`
-}
-
-// +kubebuilder:validation:Enum="nano";"micro";"small";"medium";"large";"xlarge";"2xlarge"
-type ResourcesPreset string

api/apps/v1alpha1/harbor/zz_generated.deepcopy.go

@@ -1,186 +0,0 @@
-//go:build !ignore_autogenerated
-
-/*
-Copyright 2025 The Cozystack Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-// Code generated by controller-gen. DO NOT EDIT.
-
-package harbor
-
-import (
-	runtime "k8s.io/apimachinery/pkg/runtime"
-)
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *Config) DeepCopyInto(out *Config) {
-	*out = *in
-	out.TypeMeta = in.TypeMeta
-	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
-	in.Spec.DeepCopyInto(&out.Spec)
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Config.
-func (in *Config) DeepCopy() *Config {
-	if in == nil {
-		return nil
-	}
-	out := new(Config)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
-func (in *Config) DeepCopyObject() runtime.Object {
-	if c := in.DeepCopy(); c != nil {
-		return c
-	}
-	return nil
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *ConfigSpec) DeepCopyInto(out *ConfigSpec) {
-	*out = *in
-	in.Core.DeepCopyInto(&out.Core)
-	in.Registry.DeepCopyInto(&out.Registry)
-	in.Jobservice.DeepCopyInto(&out.Jobservice)
-	in.Trivy.DeepCopyInto(&out.Trivy)
-	in.Database.DeepCopyInto(&out.Database)
-	in.Redis.DeepCopyInto(&out.Redis)
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ConfigSpec.
-func (in *ConfigSpec) DeepCopy() *ConfigSpec {
-	if in == nil {
-		return nil
-	}
-	out := new(ConfigSpec)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *Core) DeepCopyInto(out *Core) {
-	*out = *in
-	in.Resources.DeepCopyInto(&out.Resources)
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Core.
-func (in *Core) DeepCopy() *Core {
-	if in == nil {
-		return nil
-	}
-	out := new(Core)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *Database) DeepCopyInto(out *Database) {
-	*out = *in
-	out.Size = in.Size.DeepCopy()
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Database.
-func (in *Database) DeepCopy() *Database {
-	if in == nil {
-		return nil
-	}
-	out := new(Database)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *Jobservice) DeepCopyInto(out *Jobservice) {
-	*out = *in
-	in.Resources.DeepCopyInto(&out.Resources)
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Jobservice.
-func (in *Jobservice) DeepCopy() *Jobservice {
-	if in == nil {
-		return nil
-	}
-	out := new(Jobservice)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *Redis) DeepCopyInto(out *Redis) {
-	*out = *in
-	out.Size = in.Size.DeepCopy()
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Redis.
-func (in *Redis) DeepCopy() *Redis {
-	if in == nil {
-		return nil
-	}
-	out := new(Redis)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *Registry) DeepCopyInto(out *Registry) {
-	*out = *in
-	in.Resources.DeepCopyInto(&out.Resources)
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Registry.
-func (in *Registry) DeepCopy() *Registry {
-	if in == nil {
-		return nil
-	}
-	out := new(Registry)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *Resources) DeepCopyInto(out *Resources) {
-	*out = *in
-	out.Cpu = in.Cpu.DeepCopy()
-	out.Memory = in.Memory.DeepCopy()
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Resources.
-func (in *Resources) DeepCopy() *Resources {
-	if in == nil {
-		return nil
-	}
-	out := new(Resources)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *Trivy) DeepCopyInto(out *Trivy) {
-	*out = *in
-	in.Resources.DeepCopyInto(&out.Resources)
-	out.Size = in.Size.DeepCopy()
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Trivy.
-func (in *Trivy) DeepCopy() *Trivy {
-	if in == nil {
-		return nil
-	}
-	out := new(Trivy)
-	in.DeepCopyInto(out)
-	return out
-}

api/apps/v1alpha1/httpcache/types.go

@@ -1,72 +0,0 @@
-// Code generated by values-gen. DO NOT EDIT.
-// +kubebuilder:object:generate=true
-// +groupName=apps.cozystack.io
-// +versionName=v1alpha1
-package httpcache
-
-import (
-	resource "k8s.io/apimachinery/pkg/api/resource"
-	"k8s.io/apimachinery/pkg/apis/meta/v1"
-)
-
-// +kubebuilder:object:root=true
-type Config struct {
-	v1.TypeMeta   `json:",inline"`
-	v1.ObjectMeta `json:"metadata,omitempty"`
-	Spec          ConfigSpec `json:"spec,omitempty"`
-}
-
-type ConfigSpec struct {
-	// Persistent Volume Claim size available for application data.
-	// +kubebuilder:default:="10Gi"
-	Size resource.Quantity `json:"size"`
-	// StorageClass used to store the data.
-	// +kubebuilder:default:=""
-	StorageClass string `json:"storageClass"`
-	// Enable external access from outside the cluster.
-	// +kubebuilder:default:=false
-	External bool `json:"external"`
-	// Endpoints configuration, as a list of <ip:port>.
-	// +kubebuilder:default:={}
-	Endpoints []string `json:"endpoints,omitempty"`
-	// HAProxy configuration.
-	// +kubebuilder:default:={}
-	Haproxy HAProxy `json:"haproxy"`
-	// Nginx configuration.
-	// +kubebuilder:default:={}
-	Nginx Nginx `json:"nginx"`
-}
-
-type HAProxy struct {
-	// Number of HAProxy replicas.
-	// +kubebuilder:default:=2
-	Replicas int `json:"replicas"`
-	// Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.
-	// +kubebuilder:default:={}
-	Resources Resources `json:"resources,omitempty"`
-	// Default sizing preset used when `resources` is omitted.
-	// +kubebuilder:default:="nano"
-	ResourcesPreset ResourcesPreset `json:"resourcesPreset"`
-}
-
-type Nginx struct {
-	// Number of Nginx replicas.
-	// +kubebuilder:default:=2
-	Replicas int `json:"replicas"`
-	// Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.
-	// +kubebuilder:default:={}
-	Resources Resources `json:"resources,omitempty"`
-	// Default sizing preset used when `resources` is omitted.
-	// +kubebuilder:default:="nano"
-	ResourcesPreset ResourcesPreset `json:"resourcesPreset"`
-}
-
-type Resources struct {
-	// CPU available to each replica.
-	Cpu resource.Quantity `json:"cpu,omitempty"`
-	// Memory (RAM) available to each replica.
-	Memory resource.Quantity `json:"memory,omitempty"`
-}
-
-// +kubebuilder:validation:Enum="nano";"micro";"small";"medium";"large";"xlarge";"2xlarge"
-type ResourcesPreset string

api/apps/v1alpha1/httpcache/zz_generated.deepcopy.go

@@ -1,123 +0,0 @@
-//go:build !ignore_autogenerated
-
-/*
-Copyright 2025 The Cozystack Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-// Code generated by controller-gen. DO NOT EDIT.
-
-package httpcache
-
-import (
-	runtime "k8s.io/apimachinery/pkg/runtime"
-)
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *Config) DeepCopyInto(out *Config) {
-	*out = *in
-	out.TypeMeta = in.TypeMeta
-	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
-	in.Spec.DeepCopyInto(&out.Spec)
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Config.
-func (in *Config) DeepCopy() *Config {
-	if in == nil {
-		return nil
-	}
-	out := new(Config)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
-func (in *Config) DeepCopyObject() runtime.Object {
-	if c := in.DeepCopy(); c != nil {
-		return c
-	}
-	return nil
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *ConfigSpec) DeepCopyInto(out *ConfigSpec) {
-	*out = *in
-	out.Size = in.Size.DeepCopy()
-	if in.Endpoints != nil {
-		in, out := &in.Endpoints, &out.Endpoints
-		*out = make([]string, len(*in))
-		copy(*out, *in)
-	}
-	in.Haproxy.DeepCopyInto(&out.Haproxy)
-	in.Nginx.DeepCopyInto(&out.Nginx)
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ConfigSpec.
-func (in *ConfigSpec) DeepCopy() *ConfigSpec {
-	if in == nil {
-		return nil
-	}
-	out := new(ConfigSpec)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *HAProxy) DeepCopyInto(out *HAProxy) {
-	*out = *in
-	in.Resources.DeepCopyInto(&out.Resources)
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new HAProxy.
-func (in *HAProxy) DeepCopy() *HAProxy {
-	if in == nil {
-		return nil
-	}
-	out := new(HAProxy)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *Nginx) DeepCopyInto(out *Nginx) {
-	*out = *in
-	in.Resources.DeepCopyInto(&out.Resources)
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Nginx.
-func (in *Nginx) DeepCopy() *Nginx {
-	if in == nil {
-		return nil
-	}
-	out := new(Nginx)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *Resources) DeepCopyInto(out *Resources) {
-	*out = *in
-	out.Cpu = in.Cpu.DeepCopy()
-	out.Memory = in.Memory.DeepCopy()
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Resources.
-func (in *Resources) DeepCopy() *Resources {
-	if in == nil {
-		return nil
-	}
-	out := new(Resources)
-	in.DeepCopyInto(out)
-	return out
-}

api/apps/v1alpha1/kafka/types.go

@@ -1,90 +0,0 @@
-// Code generated by values-gen. DO NOT EDIT.
-// +kubebuilder:object:generate=true
-// +groupName=apps.cozystack.io
-// +versionName=v1alpha1
-package kafka
-
-import (
-	resource "k8s.io/apimachinery/pkg/api/resource"
-	"k8s.io/apimachinery/pkg/apis/meta/v1"
-	k8sRuntime "k8s.io/apimachinery/pkg/runtime"
-)
-
-// +kubebuilder:object:root=true
-type Config struct {
-	v1.TypeMeta   `json:",inline"`
-	v1.ObjectMeta `json:"metadata,omitempty"`
-	Spec          ConfigSpec `json:"spec,omitempty"`
-}
-
-type ConfigSpec struct {
-	// Enable external access from outside the cluster.
-	// +kubebuilder:default:=false
-	External bool `json:"external"`
-	// Topics configuration.
-	// +kubebuilder:default:={}
-	Topics []Topic `json:"topics,omitempty"`
-	// Kafka configuration.
-	// +kubebuilder:default:={}
-	Kafka Kafka `json:"kafka"`
-	// ZooKeeper configuration.
-	// +kubebuilder:default:={}
-	Zookeeper ZooKeeper `json:"zookeeper"`
-}
-
-type Kafka struct {
-	// Number of Kafka replicas.
-	// +kubebuilder:default:=3
-	Replicas int `json:"replicas"`
-	// Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.
-	// +kubebuilder:default:={}
-	Resources Resources `json:"resources,omitempty"`
-	// Default sizing preset used when `resources` is omitted.
-	// +kubebuilder:default:="small"
-	ResourcesPreset ResourcesPreset `json:"resourcesPreset"`
-	// Persistent Volume size for Kafka.
-	// +kubebuilder:default:="10Gi"
-	Size resource.Quantity `json:"size"`
-	// StorageClass used to store the Kafka data.
-	// +kubebuilder:default:=""
-	StorageClass string `json:"storageClass"`
-}
-
-type Resources struct {
-	// CPU available to each replica.
-	Cpu resource.Quantity `json:"cpu,omitempty"`
-	// Memory (RAM) available to each replica.
-	Memory resource.Quantity `json:"memory,omitempty"`
-}
-
-type Topic struct {
-	// Topic configuration.
-	Config k8sRuntime.RawExtension `json:"config"`
-	// Topic name.
-	Name string `json:"name"`
-	// Number of partitions.
-	Partitions int `json:"partitions"`
-	// Number of replicas.
-	Replicas int `json:"replicas"`
-}
-
-type ZooKeeper struct {
-	// Number of ZooKeeper replicas.
-	// +kubebuilder:default:=3
-	Replicas int `json:"replicas"`
-	// Explicit CPU and memory configuration. When omitted, the preset defined in `resourcesPreset` is applied.
-	// +kubebuilder:default:={}
-	Resources Resources `json:"resources,omitempty"`
-	// Default sizing preset used when `resources` is omitted.
-	// +kubebuilder:default:="small"
-	ResourcesPreset ResourcesPreset `json:"resourcesPreset"`
-	// Persistent Volume size for ZooKeeper.
-	// +kubebuilder:default:="5Gi"
-	Size resource.Quantity `json:"size"`
-	// StorageClass used to store the ZooKeeper data.
-	// +kubebuilder:default:=""
-	StorageClass string `json:"storageClass"`
-}
-
-// +kubebuilder:validation:Enum="nano";"micro";"small";"medium";"large";"xlarge";"2xlarge"
-type ResourcesPreset string

api/apps/v1alpha1/kafka/zz_generated.deepcopy.go

@@ -1,142 +0,0 @@
-//go:build !ignore_autogenerated
-
-/*
-Copyright 2025 The Cozystack Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-// Code generated by controller-gen. DO NOT EDIT.
-
-package kafka
-
-import (
-	"k8s.io/apimachinery/pkg/runtime"
-)
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *Config) DeepCopyInto(out *Config) {
-	*out = *in
-	out.TypeMeta = in.TypeMeta
-	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
-	in.Spec.DeepCopyInto(&out.Spec)
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Config.
-func (in *Config) DeepCopy() *Config {
-	if in == nil {
-		return nil
-	}
-	out := new(Config)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
-func (in *Config) DeepCopyObject() runtime.Object {
-	if c := in.DeepCopy(); c != nil {
-		return c
-	}
-	return nil
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *ConfigSpec) DeepCopyInto(out *ConfigSpec) {
-	*out = *in
-	if in.Topics != nil {
-		in, out := &in.Topics, &out.Topics
-		*out = make([]Topic, len(*in))
-		for i := range *in {
-			(*in)[i].DeepCopyInto(&(*out)[i])
-		}
-	}
-	in.Kafka.DeepCopyInto(&out.Kafka)
-	in.Zookeeper.DeepCopyInto(&out.Zookeeper)
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ConfigSpec.
-func (in *ConfigSpec) DeepCopy() *ConfigSpec {
-	if in == nil {
-		return nil
-	}
-	out := new(ConfigSpec)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *Kafka) DeepCopyInto(out *Kafka) {
-	*out = *in
-	in.Resources.DeepCopyInto(&out.Resources)
-	out.Size = in.Size.DeepCopy()
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Kafka.
-func (in *Kafka) DeepCopy() *Kafka {
-	if in == nil {
-		return nil
-	}
-	out := new(Kafka)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *Resources) DeepCopyInto(out *Resources) {
-	*out = *in
-	out.Cpu = in.Cpu.DeepCopy()
-	out.Memory = in.Memory.DeepCopy()
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Resources.
-func (in *Resources) DeepCopy() *Resources {
-	if in == nil {
-		return nil
-	}
-	out := new(Resources)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *Topic) DeepCopyInto(out *Topic) {
-	*out = *in
-	in.Config.DeepCopyInto(&out.Config)
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Topic.
-func (in *Topic) DeepCopy() *Topic {
-	if in == nil {
-		return nil
-	}
-	out := new(Topic)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *ZooKeeper) DeepCopyInto(out *ZooKeeper) {
-	*out = *in
-	in.Resources.DeepCopyInto(&out.Resources)
-	out.Size = in.Size.DeepCopy()
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ZooKeeper.
-func (in *ZooKeeper) DeepCopy() *ZooKeeper {
-	if in == nil {
-		return nil
-	}
-	out := new(ZooKeeper)
-	in.DeepCopyInto(out)
-	return out
-}

api/apps/v1alpha1/kubernetes/types.go

@@ -1,279 +0,0 @@
-// Code generated by values-gen. DO NOT EDIT.
-// +kubebuilder:object:generate=true
-// +groupName=apps.cozystack.io
-// +versionName=v1alpha1
-package kubernetes
-
-import (
-	resource "k8s.io/apimachinery/pkg/api/resource"
-	"k8s.io/apimachinery/pkg/apis/meta/v1"
-	k8sRuntime "k8s.io/apimachinery/pkg/runtime"
-)
-
-// +kubebuilder:object:root=true
-type Config struct {
-	v1.TypeMeta   `json:",inline"`
-	v1.ObjectMeta `json:"metadata,omitempty"`
-	Spec          ConfigSpec `json:"spec,omitempty"`
-}
-
-type ConfigSpec struct {
-	// StorageClass used to store the data.
-	// +kubebuilder:default:="replicated"
-	StorageClass string `json:"storageClass"`
-	// Worker nodes configuration map.
-	// +kubebuilder:default:={"md0":{"ephemeralStorage":"20Gi","gpus":{},"instanceType":"u1.medium","maxReplicas":10,"minReplicas":0,"resources":{},"roles":{"ingress-nginx"}}}
-	NodeGroups map[string]NodeGroup `json:"nodeGroups,omitempty"`
-	// Kubernetes major.minor version to deploy
-	// +kubebuilder:default:="v1.35"
-	Version Version `json:"version"`
-	// External hostname for Kubernetes cluster. Defaults to `<cluster-name>.<tenant-host>` if empty.
-	// +kubebuilder:default:=""
-	Host string `json:"host"`
-	// Cluster addons configuration.
-	// +kubebuilder:default:={}
-	Addons Addons `json:"addons"`
-	// Kubernetes control-plane configuration.
-	// +kubebuilder:default:={}
-	ControlPlane ControlPlane `json:"controlPlane"`
-	// Optional image overrides for air-gapped or rate-limited registries.
-	// +kubebuilder:default:={}
-	Images Images `json:"images"`
-}
-
-type APIServer struct {
-	// CPU and memory resources for API Server.
-	// +kubebuilder:default:={}
-	Resources Resources `json:"resources"`
-	// Preset if `resources` omitted.
-	// +kubebuilder:default:="large"
-	ResourcesPreset ResourcesPreset `json:"resourcesPreset"`
-}
-
-type Addons struct {
-	// Cert-manager addon.
-	// +kubebuilder:default:={}
-	CertManager CertManagerAddon `json:"certManager"`
-	// Cilium CNI plugin.
-	// +kubebuilder:default:={}
-	Cilium CiliumAddon `json:"cilium"`
-	// CoreDNS addon.
-	// +kubebuilder:default:={}
-	Coredns CoreDNSAddon `json:"coredns"`
-	// FluxCD GitOps operator.
-	// +kubebuilder:default:={}
-	Fluxcd FluxCDAddon `json:"fluxcd"`
-	// Gateway API addon.
-	// +kubebuilder:default:={}
-	GatewayAPI GatewayAPIAddon `json:"gatewayAPI"`
-	// NVIDIA GPU Operator.
-	// +kubebuilder:default:={}
-	GpuOperator GPUOperatorAddon `json:"gpuOperator"`
-	// HAMi GPU virtualization middleware.
-	// +kubebuilder:default:={}
-	Hami HAMiAddon `json:"hami"`
-	// Ingress-NGINX controller.
-	// +kubebuilder:default:={}
-	IngressNginx IngressNginxAddon `json:"ingressNginx"`
-	// Monitoring agents.
-	// +kubebuilder:default:={}
-	MonitoringAgents MonitoringAgentsAddon `json:"monitoringAgents"`
-	// Velero backup/restore addon.
-	// +kubebuilder:default:={}
-	Velero VeleroAddon `json:"velero"`
-	// Vertical Pod Autoscaler.
-	// +kubebuilder:default:={}
-	VerticalPodAutoscaler VerticalPodAutoscalerAddon `json:"verticalPodAutoscaler"`
-}
-
-type CertManagerAddon struct {
-	// Enable cert-manager.
-	// +kubebuilder:default:=false
-	Enabled bool `json:"enabled"`
-	// Custom Helm values overrides.
-	// +kubebuilder:default:={}
-	ValuesOverride k8sRuntime.RawExtension `json:"valuesOverride"`
-}
-
-type CiliumAddon struct {
-	// Custom Helm values overrides.
-	// +kubebuilder:default:={}
-	ValuesOverride k8sRuntime.RawExtension `json:"valuesOverride"`
-}
-
-type ControlPlane struct {
-	// API Server configuration.
-	// +kubebuilder:default:={}
-	ApiServer APIServer `json:"apiServer"`
-	// Controller Manager configuration.
-	// +kubebuilder:default:={}
-	ControllerManager ControllerManager `json:"controllerManager"`
-	// Konnectivity configuration.
-	// +kubebuilder:default:={}
-	Konnectivity Konnectivity `json:"konnectivity"`
-	// Number of control-plane replicas.
-	// +kubebuilder:default:=2
-	Replicas int `json:"replicas"`
-	// Scheduler configuration.
-	// +kubebuilder:default:={}
-	Scheduler Scheduler `json:"scheduler"`
-}
-
-type ControllerManager struct {
-	// CPU and memory resources for Controller Manager.
-	// +kubebuilder:default:={}
-	Resources Resources `json:"resources"`
-	// Preset if `resources` omitted.
-	// +kubebuilder:default:="micro"
-	ResourcesPreset ResourcesPreset `json:"resourcesPreset"`
-}
-
-type CoreDNSAddon struct {
-	// Custom Helm values overrides.
-	// +kubebuilder:default:={}
-	ValuesOverride k8sRuntime.RawExtension `json:"valuesOverride"`
-}
-
-type FluxCDAddon struct {
-	// Enable FluxCD.
-	// +kubebuilder:default:=false
-	Enabled bool `json:"enabled"`
-	// Custom Helm values overrides.
-	// +kubebuilder:default:={}
-	ValuesOverride k8sRuntime.RawExtension `json:"valuesOverride"`
-}
-
-type GPU struct {
-	// Name of GPU, such as "nvidia.com/AD102GL_L40S".
-	Name string `json:"name"`
-}
-
-type GPUOperatorAddon struct {
-	// Enable GPU Operator.
-	// +kubebuilder:default:=false
-	Enabled bool `json:"enabled"`
-	// Custom Helm values overrides.
-	// +kubebuilder:default:={}
-	ValuesOverride k8sRuntime.RawExtension `json:"valuesOverride"`
-}
-
-type GatewayAPIAddon struct {
-	// Enable Gateway API.
-	// +kubebuilder:default:=false
-	Enabled bool `json:"enabled"`
-}
-
-type HAMiAddon struct {
-	// Enable HAMi (requires GPU Operator).
-	// +kubebuilder:default:=false
-	Enabled bool `json:"enabled"`
-	// Custom Helm values overrides.
-	// +kubebuilder:default:={}
-	ValuesOverride k8sRuntime.RawExtension `json:"valuesOverride"`
-}
-
-type Images struct {
-	// Image used by the wait-for-kubeconfig init container. Empty falls back to images/busybox.tag.
-	// +kubebuilder:default:=""
-	WaitForKubeconfig string `json:"waitForKubeconfig,omitempty"`
-}
-
-type IngressNginxAddon struct {
-	// Enable the controller (requires nodes labeled `ingress-nginx`).
-	// +kubebuilder:default:=false
-	Enabled bool `json:"enabled"`
-	// Method to expose the controller. Allowed values: `Proxied`, `LoadBalancer`.
-	// +kubebuilder:default:="Proxied"
-	ExposeMethod IngressNginxExposeMethod `json:"exposeMethod"`
-	// Domains routed to this tenant cluster when `exposeMethod` is `Proxied`.
-	// +kubebuilder:default:={}
-	Hosts []string `json:"hosts,omitempty"`
-	// Custom Helm values overrides.
-	// +kubebuilder:default:={}
-	ValuesOverride k8sRuntime.RawExtension `json:"valuesOverride"`
-}
-
-type Konnectivity struct {
-	// Konnectivity Server configuration.
-	// +kubebuilder:default:={}
-	Server KonnectivityServer `json:"server"`
-}
-
-type KonnectivityServer struct {
-	// CPU and memory resources for Konnectivity.
-	// +kubebuilder:default:={}
-	Resources Resources `json:"resources"`
-	// Preset if `resources` omitted.
-	// +kubebuilder:default:="micro"
-	ResourcesPreset ResourcesPreset `json:"resourcesPreset"`
-}
-
-type MonitoringAgentsAddon struct {
-	// Enable monitoring agents.
-	// +kubebuilder:default:=false
-	Enabled bool `json:"enabled"`
-	// Custom Helm values overrides.
-	// +kubebuilder:default:={}
-	ValuesOverride k8sRuntime.RawExtension `json:"valuesOverride"`
-}
-
-type NodeGroup struct {
-	// Ephemeral storage size.
-	// +kubebuilder:default:="20Gi"
-	EphemeralStorage resource.Quantity `json:"ephemeralStorage"`
-	// List of GPUs to attach (NVIDIA driver requires at least 4 GiB RAM).
-	Gpus []GPU `json:"gpus,omitempty"`
-	// Virtual machine instance type.
-	// +kubebuilder:default:="u1.medium"
-	InstanceType string `json:"instanceType"`
-	// Maximum number of replicas.
-	// +kubebuilder:default:=10
-	MaxReplicas int `json:"maxReplicas"`
-	// Minimum number of replicas.
-	// +kubebuilder:default:=0
-	MinReplicas int `json:"minReplicas"`
-	// CPU and memory resources for each worker node.
-	Resources Resources `json:"resources"`
-	// List of node roles.
-	Roles []string `json:"roles,omitempty"`
-}
-
-type Resources struct {
-	// CPU available.
-	Cpu resource.Quantity `json:"cpu,omitempty"`
-	// Memory (RAM) available.
-	Memory resource.Quantity `json:"memory,omitempty"`
-}
-
-type Scheduler struct {
-	// CPU and memory resources for Scheduler.
-	// +kubebuilder:default:={}
-	Resources Resources `json:"resources"`
-	// Preset if `resources` omitted.
-	// +kubebuilder:default:="micro"
-	ResourcesPreset ResourcesPreset `json:"resourcesPreset"`
-}
-
-type VeleroAddon struct {
-	// Enable Velero.
-	// +kubebuilder:default:=false
-	Enabled bool `json:"enabled"`
-	// Custom Helm values overrides.
-	// +kubebuilder:default:={}
-	ValuesOverride k8sRuntime.RawExtension `json:"valuesOverride"`
-}
-
-type VerticalPodAutoscalerAddon struct {
-	// Custom Helm values overrides.
-	// +kubebuilder:default:={}
-	ValuesOverride k8sRuntime.RawExtension `json:"valuesOverride"`
-}
-
-// +kubebuilder:validation:Enum="Proxied";"LoadBalancer"
-type IngressNginxExposeMethod string
-
-// +kubebuilder:validation:Enum="nano";"micro";"small";"medium";"large";"xlarge";"2xlarge"
-type ResourcesPreset string
-
-// +kubebuilder:validation:Enum="v1.35";"v1.34";"v1.33";"v1.32";"v1.31";"v1.30"
-type Version string

api/apps/v1alpha1/kubernetes/zz_generated.deepcopy.go

@@ -1,455 +0,0 @@
-//go:build !ignore_autogenerated
-
-/*
-Copyright 2025 The Cozystack Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-// Code generated by controller-gen. DO NOT EDIT.
-
-package kubernetes
-
-import (
-	"k8s.io/apimachinery/pkg/runtime"
-)
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *APIServer) DeepCopyInto(out *APIServer) {
-	*out = *in
-	in.Resources.DeepCopyInto(&out.Resources)
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new APIServer.
-func (in *APIServer) DeepCopy() *APIServer {
-	if in == nil {
-		return nil
-	}
-	out := new(APIServer)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *Addons) DeepCopyInto(out *Addons) {
-	*out = *in
-	in.CertManager.DeepCopyInto(&out.CertManager)
-	in.Cilium.DeepCopyInto(&out.Cilium)
-	in.Coredns.DeepCopyInto(&out.Coredns)
-	in.Fluxcd.DeepCopyInto(&out.Fluxcd)
-	out.GatewayAPI = in.GatewayAPI
-	in.GpuOperator.DeepCopyInto(&out.GpuOperator)
-	in.Hami.DeepCopyInto(&out.Hami)
-	in.IngressNginx.DeepCopyInto(&out.IngressNginx)
-	in.MonitoringAgents.DeepCopyInto(&out.MonitoringAgents)
-	in.Velero.DeepCopyInto(&out.Velero)
-	in.VerticalPodAutoscaler.DeepCopyInto(&out.VerticalPodAutoscaler)
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Addons.
-func (in *Addons) DeepCopy() *Addons {
-	if in == nil {
-		return nil
-	}
-	out := new(Addons)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *CertManagerAddon) DeepCopyInto(out *CertManagerAddon) {
-	*out = *in
-	in.ValuesOverride.DeepCopyInto(&out.ValuesOverride)
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CertManagerAddon.
-func (in *CertManagerAddon) DeepCopy() *CertManagerAddon {
-	if in == nil {
-		return nil
-	}
-	out := new(CertManagerAddon)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *CiliumAddon) DeepCopyInto(out *CiliumAddon) {
-	*out = *in
-	in.ValuesOverride.DeepCopyInto(&out.ValuesOverride)
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CiliumAddon.
-func (in *CiliumAddon) DeepCopy() *CiliumAddon {
-	if in == nil {
-		return nil
-	}
-	out := new(CiliumAddon)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *Config) DeepCopyInto(out *Config) {
-	*out = *in
-	out.TypeMeta = in.TypeMeta
-	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
-	in.Spec.DeepCopyInto(&out.Spec)
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Config.
-func (in *Config) DeepCopy() *Config {
-	if in == nil {
-		return nil
-	}
-	out := new(Config)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
-func (in *Config) DeepCopyObject() runtime.Object {
-	if c := in.DeepCopy(); c != nil {
-		return c
-	}
-	return nil
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *ConfigSpec) DeepCopyInto(out *ConfigSpec) {
-	*out = *in
-	if in.NodeGroups != nil {
-		in, out := &in.NodeGroups, &out.NodeGroups
-		*out = make(map[string]NodeGroup, len(*in))
-		for key, val := range *in {
-			(*out)[key] = *val.DeepCopy()
-		}
-	}
-	in.Addons.DeepCopyInto(&out.Addons)
-	in.ControlPlane.DeepCopyInto(&out.ControlPlane)
-	out.Images = in.Images
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ConfigSpec.
-func (in *ConfigSpec) DeepCopy() *ConfigSpec {
-	if in == nil {
-		return nil
-	}
-	out := new(ConfigSpec)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *ControlPlane) DeepCopyInto(out *ControlPlane) {
-	*out = *in
-	in.ApiServer.DeepCopyInto(&out.ApiServer)
-	in.ControllerManager.DeepCopyInto(&out.ControllerManager)
-	in.Konnectivity.DeepCopyInto(&out.Konnectivity)
-	in.Scheduler.DeepCopyInto(&out.Scheduler)
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ControlPlane.
-func (in *ControlPlane) DeepCopy() *ControlPlane {
-	if in == nil {
-		return nil
-	}
-	out := new(ControlPlane)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *ControllerManager) DeepCopyInto(out *ControllerManager) {
-	*out = *in
-	in.Resources.DeepCopyInto(&out.Resources)
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ControllerManager.
-func (in *ControllerManager) DeepCopy() *ControllerManager {
-	if in == nil {
-		return nil
-	}
-	out := new(ControllerManager)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *CoreDNSAddon) DeepCopyInto(out *CoreDNSAddon) {
-	*out = *in
-	in.ValuesOverride.DeepCopyInto(&out.ValuesOverride)
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CoreDNSAddon.
-func (in *CoreDNSAddon) DeepCopy() *CoreDNSAddon {
-	if in == nil {
-		return nil
-	}
-	out := new(CoreDNSAddon)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *FluxCDAddon) DeepCopyInto(out *FluxCDAddon) {
-	*out = *in
-	in.ValuesOverride.DeepCopyInto(&out.ValuesOverride)
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new FluxCDAddon.
-func (in *FluxCDAddon) DeepCopy() *FluxCDAddon {
-	if in == nil {
-		return nil
-	}
-	out := new(FluxCDAddon)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *GPU) DeepCopyInto(out *GPU) {
-	*out = *in
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GPU.
-func (in *GPU) DeepCopy() *GPU {
-	if in == nil {
-		return nil
-	}
-	out := new(GPU)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *GPUOperatorAddon) DeepCopyInto(out *GPUOperatorAddon) {
-	*out = *in
-	in.ValuesOverride.DeepCopyInto(&out.ValuesOverride)
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GPUOperatorAddon.
-func (in *GPUOperatorAddon) DeepCopy() *GPUOperatorAddon {
-	if in == nil {
-		return nil
-	}
-	out := new(GPUOperatorAddon)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *GatewayAPIAddon) DeepCopyInto(out *GatewayAPIAddon) {
-	*out = *in
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GatewayAPIAddon.
-func (in *GatewayAPIAddon) DeepCopy() *GatewayAPIAddon {
-	if in == nil {
-		return nil
-	}
-	out := new(GatewayAPIAddon)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *HAMiAddon) DeepCopyInto(out *HAMiAddon) {
-	*out = *in
-	in.ValuesOverride.DeepCopyInto(&out.ValuesOverride)
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new HAMiAddon.
-func (in *HAMiAddon) DeepCopy() *HAMiAddon {
-	if in == nil {
-		return nil
-	}
-	out := new(HAMiAddon)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *Images) DeepCopyInto(out *Images) {
-	*out = *in
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Images.
-func (in *Images) DeepCopy() *Images {
-	if in == nil {
-		return nil
-	}
-	out := new(Images)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *IngressNginxAddon) DeepCopyInto(out *IngressNginxAddon) {
-	*out = *in
-	if in.Hosts != nil {
-		in, out := &in.Hosts, &out.Hosts
-		*out = make([]string, len(*in))
-		copy(*out, *in)
-	}
-	in.ValuesOverride.DeepCopyInto(&out.ValuesOverride)
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new IngressNginxAddon.
-func (in *IngressNginxAddon) DeepCopy() *IngressNginxAddon {
-	if in == nil {
-		return nil
-	}
-	out := new(IngressNginxAddon)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *Konnectivity) DeepCopyInto(out *Konnectivity) {
-	*out = *in
-	in.Server.DeepCopyInto(&out.Server)
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Konnectivity.
-func (in *Konnectivity) DeepCopy() *Konnectivity {
-	if in == nil {
-		return nil
-	}
-	out := new(Konnectivity)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *KonnectivityServer) DeepCopyInto(out *KonnectivityServer) {
-	*out = *in
-	in.Resources.DeepCopyInto(&out.Resources)
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new KonnectivityServer.
-func (in *KonnectivityServer) DeepCopy() *KonnectivityServer {
-	if in == nil {
-		return nil
-	}
-	out := new(KonnectivityServer)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *MonitoringAgentsAddon) DeepCopyInto(out *MonitoringAgentsAddon) {
-	*out = *in
-	in.ValuesOverride.DeepCopyInto(&out.ValuesOverride)
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new MonitoringAgentsAddon.
-func (in *MonitoringAgentsAddon) DeepCopy() *MonitoringAgentsAddon {
-	if in == nil {
-		return nil
-	}
-	out := new(MonitoringAgentsAddon)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *NodeGroup) DeepCopyInto(out *NodeGroup) {
-	*out = *in
-	out.EphemeralStorage = in.EphemeralStorage.DeepCopy()
-	if in.Gpus != nil {
-		in, out := &in.Gpus, &out.Gpus
-		*out = make([]GPU, len(*in))
-		copy(*out, *in)
-	}
-	in.Resources.DeepCopyInto(&out.Resources)
-	if in.Roles != nil {
-		in, out := &in.Roles, &out.Roles
-		*out = make([]string, len(*in))
-		copy(*out, *in)
-	}
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new NodeGroup.
-func (in *NodeGroup) DeepCopy() *NodeGroup {
-	if in == nil {
-		return nil
-	}
-	out := new(NodeGroup)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *Resources) DeepCopyInto(out *Resources) {
-	*out = *in
-	out.Cpu = in.Cpu.DeepCopy()
-	out.Memory = in.Memory.DeepCopy()
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Resources.
-func (in *Resources) DeepCopy() *Resources {
-	if in == nil {
-		return nil
-	}
-	out := new(Resources)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *Scheduler) DeepCopyInto(out *Scheduler) {
-	*out = *in
-	in.Resources.DeepCopyInto(&out.Resources)
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Scheduler.
-func (in *Scheduler) DeepCopy() *Scheduler {
-	if in == nil {
-		return nil
-	}
-	out := new(Scheduler)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *VeleroAddon) DeepCopyInto(out *VeleroAddon) {
-	*out = *in
-	in.ValuesOverride.DeepCopyInto(&out.ValuesOverride)
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new VeleroAddon.
-func (in *VeleroAddon) DeepCopy() *VeleroAddon {
-	if in == nil {
-		return nil
-	}
-	out := new(VeleroAddon)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *VerticalPodAutoscalerAddon) DeepCopyInto(out *VerticalPodAutoscalerAddon) {
-	*out = *in
-	in.ValuesOverride.DeepCopyInto(&out.ValuesOverride)
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new VerticalPodAutoscalerAddon.
-func (in *VerticalPodAutoscalerAddon) DeepCopy() *VerticalPodAutoscalerAddon {
-	if in == nil {
-		return nil
-	}
-	out := new(VerticalPodAutoscalerAddon)
-	in.DeepCopyInto(out)
-	return out
-}

api/apps/v1alpha1/mariadb/types.go

@@ -1,109 +0,0 @@
-// Code generated by values-gen. DO NOT EDIT.
-// +kubebuilder:object:generate=true
-// +groupName=apps.cozystack.io
-// +versionName=v1alpha1
-package mariadb
-
-import (
-	resource "k8s.io/apimachinery/pkg/api/resource"
-	"k8s.io/apimachinery/pkg/apis/meta/v1"
-)
-
-// +kubebuilder:object:root=true
-type Config struct {
-	v1.TypeMeta   `json:",inline"`
-	v1.ObjectMeta `json:"metadata,omitempty"`
-	Spec          ConfigSpec `json:"spec,omitempty"`
-}
-
-type ConfigSpec struct {
-	// Number of MariaDB replicas.
-	// +kubebuilder:default:=2
-	Replicas int `json:"replicas"`
-	// Explicit CPU and memory configuration for each MariaDB replica. When omitted, the preset defined in `resourcesPreset` is applied.
-	// +kubebuilder:default:={}
-	Resources Resources `json:"resources,omitempty"`
-	// Default sizing preset used when `resources` is omitted.
-	// +kubebuilder:default:="nano"
-	ResourcesPreset ResourcesPreset `json:"resourcesPreset"`
-	// Persistent Volume Claim size available for application data.
-	// +kubebuilder:default:="10Gi"
-	Size resource.Quantity `json:"size"`
-	// StorageClass used to store the data.
-	// +kubebuilder:default:=""
-	StorageClass string `json:"storageClass"`
-	// Enable external access from outside the cluster.
-	// +kubebuilder:default:=false
-	External bool `json:"external"`
-	// MariaDB major.minor version to deploy
-	// +kubebuilder:default:="v11.8"
-	Version Version `json:"version"`
-	// Users configuration map.
-	// +kubebuilder:default:={}
-	Users map[string]User `json:"users,omitempty"`
-	// Databases configuration map.
-	// +kubebuilder:default:={}
-	Databases map[string]Database `json:"databases,omitempty"`
-	// Backup configuration.
-	// +kubebuilder:default:={}
-	Backup Backup `json:"backup"`
-}
-
-type Backup struct {
-	// Retention strategy for cleaning up old backups.
-	// +kubebuilder:default:="--keep-last=3 --keep-daily=3 --keep-within-weekly=1m"
-	CleanupStrategy string `json:"cleanupStrategy"`
-	// Enable regular backups (default: false).
-	// +kubebuilder:default:=false
-	Enabled bool `json:"enabled"`
-	// Password for Restic backup encryption.
-	// +kubebuilder:default:="<password>"
-	ResticPassword string `json:"resticPassword"`
-	// Access key for S3 authentication.
-	// +kubebuilder:default:="<your-access-key>"
-	S3AccessKey string `json:"s3AccessKey"`
-	// S3 bucket used for storing backups.
-	// +kubebuilder:default:="s3.example.org/mariadb-backups"
-	S3Bucket string `json:"s3Bucket"`
-	// AWS S3 region where backups are stored.
-	// +kubebuilder:default:="us-east-1"
-	S3Region string `json:"s3Region"`
-	// Secret key for S3 authentication.
-	// +kubebuilder:default:="<your-secret-key>"
-	S3SecretKey string `json:"s3SecretKey"`
-	// Cron schedule for automated backups.
-	// +kubebuilder:default:="0 2 * * *"
-	Schedule string `json:"schedule"`
-}
-
-type Database struct {
-	// Roles assigned to users.
-	Roles DatabaseRoles `json:"roles,omitempty"`
-}
-
-type DatabaseRoles struct {
-	// List of users with admin privileges.
-	Admin []string `json:"admin,omitempty"`
-	// List of users with read-only privileges.
-	Readonly []string `json:"readonly,omitempty"`
-}
-
-type Resources struct {
-	// CPU available to each replica.
-	Cpu resource.Quantity `json:"cpu,omitempty"`
-	// Memory (RAM) available to each replica.
-	Memory resource.Quantity `json:"memory,omitempty"`
-}
-
-type User struct {
-	// Maximum number of connections.
-	MaxUserConnections int `json:"maxUserConnections"`
-	// Password for the user.
-	Password string `json:"password"`
-}
-
-// +kubebuilder:validation:Enum="nano";"micro";"small";"medium";"large";"xlarge";"2xlarge"
-type ResourcesPreset string
-
-// +kubebuilder:validation:Enum="v11.8";"v11.4";"v10.11";"v10.6"
-type Version string

api/apps/v1alpha1/mariadb/zz_generated.deepcopy.go

@@ -1,171 +0,0 @@
-//go:build !ignore_autogenerated
-
-/*
-Copyright 2025 The Cozystack Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-// Code generated by controller-gen. DO NOT EDIT.
-
-package mariadb
-
-import (
-	runtime "k8s.io/apimachinery/pkg/runtime"
-)
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *Backup) DeepCopyInto(out *Backup) {
-	*out = *in
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Backup.
-func (in *Backup) DeepCopy() *Backup {
-	if in == nil {
-		return nil
-	}
-	out := new(Backup)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *Config) DeepCopyInto(out *Config) {
-	*out = *in
-	out.TypeMeta = in.TypeMeta
-	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
-	in.Spec.DeepCopyInto(&out.Spec)
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Config.
-func (in *Config) DeepCopy() *Config {
-	if in == nil {
-		return nil
-	}
-	out := new(Config)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
-func (in *Config) DeepCopyObject() runtime.Object {
-	if c := in.DeepCopy(); c != nil {
-		return c
-	}
-	return nil
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *ConfigSpec) DeepCopyInto(out *ConfigSpec) {
-	*out = *in
-	in.Resources.DeepCopyInto(&out.Resources)
-	out.Size = in.Size.DeepCopy()
-	if in.Users != nil {
-		in, out := &in.Users, &out.Users
-		*out = make(map[string]User, len(*in))
-		for key, val := range *in {
-			(*out)[key] = val
-		}
-	}
-	if in.Databases != nil {
-		in, out := &in.Databases, &out.Databases
-		*out = make(map[string]Database, len(*in))
-		for key, val := range *in {
-			(*out)[key] = *val.DeepCopy()
-		}
-	}
-	out.Backup = in.Backup
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ConfigSpec.
-func (in *ConfigSpec) DeepCopy() *ConfigSpec {
-	if in == nil {
-		return nil
-	}
-	out := new(ConfigSpec)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *Database) DeepCopyInto(out *Database) {
-	*out = *in
-	in.Roles.DeepCopyInto(&out.Roles)
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Database.
-func (in *Database) DeepCopy() *Database {
-	if in == nil {
-		return nil
-	}
-	out := new(Database)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *DatabaseRoles) DeepCopyInto(out *DatabaseRoles) {
-	*out = *in
-	if in.Admin != nil {
-		in, out := &in.Admin, &out.Admin
-		*out = make([]string, len(*in))
-		copy(*out, *in)
-	}
-	if in.Readonly != nil {
-		in, out := &in.Readonly, &out.Readonly
-		*out = make([]string, len(*in))
-		copy(*out, *in)
-	}
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new DatabaseRoles.
-func (in *DatabaseRoles) DeepCopy() *DatabaseRoles {
-	if in == nil {
-		return nil
-	}
-	out := new(DatabaseRoles)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *Resources) DeepCopyInto(out *Resources) {
-	*out = *in
-	out.Cpu = in.Cpu.DeepCopy()
-	out.Memory = in.Memory.DeepCopy()
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Resources.
-func (in *Resources) DeepCopy() *Resources {
-	if in == nil {
-		return nil
-	}
-	out := new(Resources)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *User) DeepCopyInto(out *User) {
-	*out = *in
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new User.
-func (in *User) DeepCopy() *User {
-	if in == nil {
-		return nil
-	}
-	out := new(User)
-	in.DeepCopyInto(out)
-	return out
-}

api/apps/v1alpha1/mongodb/types.go

@@ -1,149 +0,0 @@
-// Code generated by values-gen. DO NOT EDIT.
-// +kubebuilder:object:generate=true
-// +groupName=apps.cozystack.io
-// +versionName=v1alpha1
-package mongodb
-
-import (
-	resource "k8s.io/apimachinery/pkg/api/resource"
-	"k8s.io/apimachinery/pkg/apis/meta/v1"
-)
-
-// +kubebuilder:object:root=true
-type Config struct {
-	v1.TypeMeta   `json:",inline"`
-	v1.ObjectMeta `json:"metadata,omitempty"`
-	Spec          ConfigSpec `json:"spec,omitempty"`
-}
-
-type ConfigSpec struct {
-	// Number of MongoDB replicas in replica set.
-	// +kubebuilder:default:=3
-	Replicas int `json:"replicas"`
-	// Explicit CPU and memory configuration for each MongoDB replica. When omitted, the preset defined in `resourcesPreset` is applied.
-	// +kubebuilder:default:={}
-	Resources Resources `json:"resources,omitempty"`
-	// Default sizing preset used when `resources` is omitted.
-	// +kubebuilder:default:="small"
-	ResourcesPreset ResourcesPreset `json:"resourcesPreset"`
-	// Persistent Volume Claim size available for application data.
-	// +kubebuilder:default:="10Gi"
-	Size resource.Quantity `json:"size"`
-	// StorageClass used to store the data.
-	// +kubebuilder:default:=""
-	StorageClass string `json:"storageClass"`
-	// Enable external access from outside the cluster.
-	// +kubebuilder:default:=false
-	External bool `json:"external"`
-	// MongoDB major version to deploy.
-	// +kubebuilder:default:="v8"
-	Version Version `json:"version"`
-	// Enable sharded cluster mode. When disabled, deploys a replica set.
-	// +kubebuilder:default:=false
-	Sharding bool `json:"sharding"`
-	// Configuration for sharded cluster mode.
-	// +kubebuilder:default:={}
-	ShardingConfig ShardingConfig `json:"shardingConfig"`
-	// Users configuration map.
-	// +kubebuilder:default:={}
-	Users map[string]User `json:"users,omitempty"`
-	// Databases configuration map.
-	// +kubebuilder:default:={}
-	Databases map[string]Database `json:"databases,omitempty"`
-	// Backup configuration.
-	// +kubebuilder:default:={}
-	Backup Backup `json:"backup"`
-	// Bootstrap configuration.
-	// +kubebuilder:default:={}
-	Bootstrap Bootstrap `json:"bootstrap"`
-}
-
-type Backup struct {
-	// Destination path for backups (e.g. s3://bucket/path/).
-	// +kubebuilder:default:="s3://bucket/path/to/folder/"
-	DestinationPath string `json:"destinationPath,omitempty"`
-	// Enable regular backups.
-	// +kubebuilder:default:=false
-	Enabled bool `json:"enabled"`
-	// S3 endpoint URL for uploads.
-	// +kubebuilder:default:="http://minio-gateway-service:9000"
-	EndpointURL string `json:"endpointURL,omitempty"`
-	// Retention policy (e.g. "30d").
-	// +kubebuilder:default:="30d"
-	RetentionPolicy string `json:"retentionPolicy,omitempty"`
-	// Access key for S3 authentication.
-	// +kubebuilder:default:=""
-	S3AccessKey string `json:"s3AccessKey,omitempty"`
-	// Secret key for S3 authentication.
-	// +kubebuilder:default:=""
-	S3SecretKey string `json:"s3SecretKey,omitempty"`
-	// Cron schedule for automated backups.
-	// +kubebuilder:default:="0 2 * * *"
-	Schedule string `json:"schedule,omitempty"`
-}
-
-type Bootstrap struct {
-	// Name of backup to restore from.
-	// +kubebuilder:default:=""
-	BackupName string `json:"backupName"`
-	// Whether to restore from a backup.
-	// +kubebuilder:default:=false
-	Enabled bool `json:"enabled"`
-	// Timestamp for point-in-time recovery; empty means latest.
-	// +kubebuilder:default:=""
-	RecoveryTime string `json:"recoveryTime,omitempty"`
-}
-
-type Database struct {
-	// Roles assigned to users.
-	Roles DatabaseRoles `json:"roles,omitempty"`
-}
-
-type DatabaseRoles struct {
-	// List of users with admin privileges (readWrite + dbAdmin).
-	Admin []string `json:"admin,omitempty"`
-	// List of users with read-only privileges.
-	Readonly []string `json:"readonly,omitempty"`
-}
-
-type Resources struct {
-	// CPU available to each replica.
-	Cpu resource.Quantity `json:"cpu,omitempty"`
-	// Memory (RAM) available to each replica.
-	Memory resource.Quantity `json:"memory,omitempty"`
-}
-
-type Shard struct {
-	// Shard name.
-	Name string `json:"name"`
-	// Number of replicas in this shard.
-	Replicas int `json:"replicas"`
-	// PVC size for this shard.
-	Size resource.Quantity `json:"size"`
-}
-
-type ShardingConfig struct {
-	// PVC size for config servers.
-	// +kubebuilder:default:="3Gi"
-	ConfigServerSize resource.Quantity `json:"configServerSize"`
-	// Number of config server replicas.
-	// +kubebuilder:default:=3
-	ConfigServers int `json:"configServers"`
-	// Number of mongos router replicas.
-	// +kubebuilder:default:=2
-	Mongos int `json:"mongos"`
-	// List of shard configurations.
-	// +kubebuilder:default:={{"name":"rs0","replicas":3,"size":"10Gi"}}
-	Shards []Shard `json:"shards,omitempty"`
-}
-
-type User struct {
-	// Password for the user (auto-generated if omitted).
-	Password string `json:"password,omitempty"`
-}
-
-// +kubebuilder:validation:Enum="nano";"micro";"small";"medium";"large";"xlarge";"2xlarge"
-type ResourcesPreset string
-
-// +kubebuilder:validation:Enum="v8";"v7";"v6"
-type Version string

api/apps/v1alpha1/mongodb/zz_generated.deepcopy.go

@@ -1,227 +0,0 @@
-//go:build !ignore_autogenerated
-
-/*
-Copyright 2025 The Cozystack Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-// Code generated by controller-gen. DO NOT EDIT.
-
-package mongodb
-
-import (
-	runtime "k8s.io/apimachinery/pkg/runtime"
-)
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *Backup) DeepCopyInto(out *Backup) {
-	*out = *in
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Backup.
-func (in *Backup) DeepCopy() *Backup {
-	if in == nil {
-		return nil
-	}
-	out := new(Backup)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *Bootstrap) DeepCopyInto(out *Bootstrap) {
-	*out = *in
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Bootstrap.
-func (in *Bootstrap) DeepCopy() *Bootstrap {
-	if in == nil {
-		return nil
-	}
-	out := new(Bootstrap)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *Config) DeepCopyInto(out *Config) {
-	*out = *in
-	out.TypeMeta = in.TypeMeta
-	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
-	in.Spec.DeepCopyInto(&out.Spec)
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Config.
-func (in *Config) DeepCopy() *Config {
-	if in == nil {
-		return nil
-	}
-	out := new(Config)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
-func (in *Config) DeepCopyObject() runtime.Object {
-	if c := in.DeepCopy(); c != nil {
-		return c
-	}
-	return nil
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *ConfigSpec) DeepCopyInto(out *ConfigSpec) {
-	*out = *in
-	in.Resources.DeepCopyInto(&out.Resources)
-	out.Size = in.Size.DeepCopy()
-	in.ShardingConfig.DeepCopyInto(&out.ShardingConfig)
-	if in.Users != nil {
-		in, out := &in.Users, &out.Users
-		*out = make(map[string]User, len(*in))
-		for key, val := range *in {
-			(*out)[key] = val
-		}
-	}
-	if in.Databases != nil {
-		in, out := &in.Databases, &out.Databases
-		*out = make(map[string]Database, len(*in))
-		for key, val := range *in {
-			(*out)[key] = *val.DeepCopy()
-		}
-	}
-	out.Backup = in.Backup
-	out.Bootstrap = in.Bootstrap
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ConfigSpec.
-func (in *ConfigSpec) DeepCopy() *ConfigSpec {
-	if in == nil {
-		return nil
-	}
-	out := new(ConfigSpec)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *Database) DeepCopyInto(out *Database) {
-	*out = *in
-	in.Roles.DeepCopyInto(&out.Roles)
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Database.
-func (in *Database) DeepCopy() *Database {
-	if in == nil {
-		return nil
-	}
-	out := new(Database)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *DatabaseRoles) DeepCopyInto(out *DatabaseRoles) {
-	*out = *in
-	if in.Admin != nil {
-		in, out := &in.Admin, &out.Admin
-		*out = make([]string, len(*in))
-		copy(*out, *in)
-	}
-	if in.Readonly != nil {
-		in, out := &in.Readonly, &out.Readonly
-		*out = make([]string, len(*in))
-		copy(*out, *in)
-	}
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new DatabaseRoles.
-func (in *DatabaseRoles) DeepCopy() *DatabaseRoles {
-	if in == nil {
-		return nil
-	}
-	out := new(DatabaseRoles)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *Resources) DeepCopyInto(out *Resources) {
-	*out = *in
-	out.Cpu = in.Cpu.DeepCopy()
-	out.Memory = in.Memory.DeepCopy()
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Resources.
-func (in *Resources) DeepCopy() *Resources {
-	if in == nil {
-		return nil
-	}
-	out := new(Resources)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *Shard) DeepCopyInto(out *Shard) {
-	*out = *in
-	out.Size = in.Size.DeepCopy()
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Shard.
-func (in *Shard) DeepCopy() *Shard {
-	if in == nil {
-		return nil
-	}
-	out := new(Shard)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *ShardingConfig) DeepCopyInto(out *ShardingConfig) {
-	*out = *in
-	out.ConfigServerSize = in.ConfigServerSize.DeepCopy()
-	if in.Shards != nil {
-		in, out := &in.Shards, &out.Shards
-		*out = make([]Shard, len(*in))
-		for i := range *in {
-			(*in)[i].DeepCopyInto(&(*out)[i])
-		}
-	}
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ShardingConfig.
-func (in *ShardingConfig) DeepCopy() *ShardingConfig {
-	if in == nil {
-		return nil
-	}
-	out := new(ShardingConfig)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *User) DeepCopyInto(out *User) {
-	*out = *in
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new User.
-func (in *User) DeepCopy() *User {
-	if in == nil {
-		return nil
-	}
-	out := new(User)
-	in.DeepCopyInto(out)
-	return out
-}

api/apps/v1alpha1/nats/types.go

@@ -1,78 +0,0 @@
-// Code generated by values-gen. DO NOT EDIT.
-// +kubebuilder:object:generate=true
-// +groupName=apps.cozystack.io
-// +versionName=v1alpha1
-package nats
-
-import (
-	resource "k8s.io/apimachinery/pkg/api/resource"
-	"k8s.io/apimachinery/pkg/apis/meta/v1"
-	k8sRuntime "k8s.io/apimachinery/pkg/runtime"
-)
-
-// +kubebuilder:object:root=true
-type Config struct {
-	v1.TypeMeta   `json:",inline"`
-	v1.ObjectMeta `json:"metadata,omitempty"`
-	Spec          ConfigSpec `json:"spec,omitempty"`
-}
-
-type ConfigSpec struct {
-	// Number of replicas.
-	// +kubebuilder:default:=2
-	Replicas int `json:"replicas"`
-	// Explicit CPU and memory configuration for each NATS replica. When omitted, the preset defined in `resourcesPreset` is applied.
-	// +kubebuilder:default:={}
-	Resources Resources `json:"resources,omitempty"`
-	// Default sizing preset used when `resources` is omitted.
-	// +kubebuilder:default:="nano"
-	ResourcesPreset ResourcesPreset `json:"resourcesPreset"`
-	// StorageClass used to store the data.
-	// +kubebuilder:default:=""
-	StorageClass string `json:"storageClass"`
-	// Enable external access from outside the cluster.
-	// +kubebuilder:default:=false
-	External bool `json:"external"`
-	// Users configuration map.
-	// +kubebuilder:default:={}
-	Users map[string]User `json:"users,omitempty"`
-	// Jetstream configuration.
-	// +kubebuilder:default:={}
-	Jetstream Jetstream `json:"jetstream"`
-	// NATS configuration.
-	// +kubebuilder:default:={}
-	Config ValuesConfig `json:"config"`
-}
-
-type ValuesConfig struct {
-	// Additional configuration to merge into NATS config.
-	// +kubebuilder:default:={}
-	Merge *k8sRuntime.RawExtension `json:"merge,omitempty"`
-	// Additional resolver configuration to merge into NATS config.
-	// +kubebuilder:default:={}
-	Resolver *k8sRuntime.RawExtension `json:"resolver,omitempty"`
-}
-
-type Jetstream struct {
-	// Enable or disable Jetstream for persistent messaging in NATS.
-	// +kubebuilder:default:=true
-	Enabled bool `json:"enabled"`
-	// Jetstream persistent storage size.
-	// +kubebuilder:default:="10Gi"
-	Size resource.Quantity `json:"size"`
-}
-
-type Resources struct {
-	// CPU available to each replica.
-	Cpu resource.Quantity `json:"cpu,omitempty"`
-	// Memory (RAM) available to each replica.
-	Memory resource.Quantity `json:"memory,omitempty"`
-}
-
-type User struct {
-	// Password for the user.
-	Password string `json:"password,omitempty"`
-}
-
-// +kubebuilder:validation:Enum="nano";"micro";"small";"medium";"large";"xlarge";"2xlarge"
-type ResourcesPreset string

api/apps/v1alpha1/nats/zz_generated.deepcopy.go

@@ -1,149 +0,0 @@
-//go:build !ignore_autogenerated
-
-/*
-Copyright 2025 The Cozystack Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-// Code generated by controller-gen. DO NOT EDIT.
-
-package nats
-
-import (
-	"k8s.io/apimachinery/pkg/runtime"
-)
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *Config) DeepCopyInto(out *Config) {
-	*out = *in
-	out.TypeMeta = in.TypeMeta
-	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
-	in.Spec.DeepCopyInto(&out.Spec)
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Config.
-func (in *Config) DeepCopy() *Config {
-	if in == nil {
-		return nil
-	}
-	out := new(Config)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
-func (in *Config) DeepCopyObject() runtime.Object {
-	if c := in.DeepCopy(); c != nil {
-		return c
-	}
-	return nil
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *ConfigSpec) DeepCopyInto(out *ConfigSpec) {
-	*out = *in
-	in.Resources.DeepCopyInto(&out.Resources)
-	if in.Users != nil {
-		in, out := &in.Users, &out.Users
-		*out = make(map[string]User, len(*in))
-		for key, val := range *in {
-			(*out)[key] = val
-		}
-	}
-	in.Jetstream.DeepCopyInto(&out.Jetstream)
-	in.Config.DeepCopyInto(&out.Config)
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ConfigSpec.
-func (in *ConfigSpec) DeepCopy() *ConfigSpec {
-	if in == nil {
-		return nil
-	}
-	out := new(ConfigSpec)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *Jetstream) DeepCopyInto(out *Jetstream) {
-	*out = *in
-	out.Size = in.Size.DeepCopy()
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Jetstream.
-func (in *Jetstream) DeepCopy() *Jetstream {
-	if in == nil {
-		return nil
-	}
-	out := new(Jetstream)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *Resources) DeepCopyInto(out *Resources) {
-	*out = *in
-	out.Cpu = in.Cpu.DeepCopy()
-	out.Memory = in.Memory.DeepCopy()
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Resources.
-func (in *Resources) DeepCopy() *Resources {
-	if in == nil {
-		return nil
-	}
-	out := new(Resources)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *User) DeepCopyInto(out *User) {
-	*out = *in
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new User.
-func (in *User) DeepCopy() *User {
-	if in == nil {
-		return nil
-	}
-	out := new(User)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *ValuesConfig) DeepCopyInto(out *ValuesConfig) {
-	*out = *in
-	if in.Merge != nil {
-		in, out := &in.Merge, &out.Merge
-		*out = new(runtime.RawExtension)
-		(*in).DeepCopyInto(*out)
-	}
-	if in.Resolver != nil {
-		in, out := &in.Resolver, &out.Resolver
-		*out = new(runtime.RawExtension)
-		(*in).DeepCopyInto(*out)
-	}
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ValuesConfig.
-func (in *ValuesConfig) DeepCopy() *ValuesConfig {
-	if in == nil {
-		return nil
-	}
-	out := new(ValuesConfig)
-	in.DeepCopyInto(out)
-	return out
-}

api/apps/v1alpha1/openbao/types.go

@@ -1,51 +0,0 @@
-// Code generated by values-gen. DO NOT EDIT.
-// +kubebuilder:object:generate=true
-// +groupName=apps.cozystack.io
-// +versionName=v1alpha1
-package openbao
-
-import (
-	resource "k8s.io/apimachinery/pkg/api/resource"
-	"k8s.io/apimachinery/pkg/apis/meta/v1"
-)
-
-// +kubebuilder:object:root=true
-type Config struct {
-	v1.TypeMeta   `json:",inline"`
-	v1.ObjectMeta `json:"metadata,omitempty"`
-	Spec          ConfigSpec `json:"spec,omitempty"`
-}
-
-type ConfigSpec struct {
-	// Number of OpenBAO replicas. HA with Raft is automatically enabled when replicas > 1. Switching between standalone (file storage) and HA (Raft storage) modes requires data migration.
-	// +kubebuilder:default:=1
-	Replicas int `json:"replicas"`
-	// Explicit CPU and memory configuration for each OpenBAO replica. When omitted, the preset defined in `resourcesPreset` is applied.
-	// +kubebuilder:default:={}
-	Resources Resources `json:"resources,omitempty"`
-	// Default sizing preset used when `resources` is omitted.
-	// +kubebuilder:default:="small"
-	ResourcesPreset ResourcesPreset `json:"resourcesPreset"`
-	// Persistent Volume Claim size for data storage.
-	// +kubebuilder:default:="10Gi"
-	Size resource.Quantity `json:"size"`
-	// StorageClass used to store the data.
-	// +kubebuilder:default:=""
-	StorageClass string `json:"storageClass"`
-	// Enable external access from outside the cluster.
-	// +kubebuilder:default:=false
-	External bool `json:"external"`
-	// Enable the OpenBAO web UI.
-	// +kubebuilder:default:=true
-	Ui bool `json:"ui"`
-}
-
-type Resources struct {
-	// CPU available to each replica.
-	Cpu resource.Quantity `json:"cpu,omitempty"`
-	// Memory (RAM) available to each replica.
-	Memory resource.Quantity `json:"memory,omitempty"`
-}
-
-// +kubebuilder:validation:Enum="nano";"micro";"small";"medium";"large";"xlarge";"2xlarge"
-type ResourcesPreset string

api/apps/v1alpha1/openbao/zz_generated.deepcopy.go

@@ -1,85 +0,0 @@
-//go:build !ignore_autogenerated
-
-/*
-Copyright 2025 The Cozystack Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-// Code generated by controller-gen. DO NOT EDIT.
-
-package openbao
-
-import (
-	runtime "k8s.io/apimachinery/pkg/runtime"
-)
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *Config) DeepCopyInto(out *Config) {
-	*out = *in
-	out.TypeMeta = in.TypeMeta
-	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
-	in.Spec.DeepCopyInto(&out.Spec)
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Config.
-func (in *Config) DeepCopy() *Config {
-	if in == nil {
-		return nil
-	}
-	out := new(Config)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
-func (in *Config) DeepCopyObject() runtime.Object {
-	if c := in.DeepCopy(); c != nil {
-		return c
-	}
-	return nil
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *ConfigSpec) DeepCopyInto(out *ConfigSpec) {
-	*out = *in
-	in.Resources.DeepCopyInto(&out.Resources)
-	out.Size = in.Size.DeepCopy()
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ConfigSpec.
-func (in *ConfigSpec) DeepCopy() *ConfigSpec {
-	if in == nil {
-		return nil
-	}
-	out := new(ConfigSpec)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *Resources) DeepCopyInto(out *Resources) {
-	*out = *in
-	out.Cpu = in.Cpu.DeepCopy()
-	out.Memory = in.Memory.DeepCopy()
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Resources.
-func (in *Resources) DeepCopy() *Resources {
-	if in == nil {
-		return nil
-	}
-	out := new(Resources)
-	in.DeepCopyInto(out)
-	return out
-}

api/apps/v1alpha1/opensearch/types.go

@@ -1,115 +0,0 @@
-// Code generated by values-gen. DO NOT EDIT.
-// +kubebuilder:object:generate=true
-// +groupName=apps.cozystack.io
-// +versionName=v1alpha1
-package opensearch
-
-import (
-	resource "k8s.io/apimachinery/pkg/api/resource"
-	"k8s.io/apimachinery/pkg/apis/meta/v1"
-)
-
-// +kubebuilder:object:root=true
-type Config struct {
-	v1.TypeMeta   `json:",inline"`
-	v1.ObjectMeta `json:"metadata,omitempty"`
-	Spec          ConfigSpec `json:"spec,omitempty"`
-}
-
-type ConfigSpec struct {
-	// Number of OpenSearch nodes in the cluster.
-	// +kubebuilder:default:=3
-	Replicas int `json:"replicas"`
-	// Explicit CPU and memory configuration for each OpenSearch node. When omitted, the preset defined in `resourcesPreset` is applied.
-	// +kubebuilder:default:={}
-	Resources Resources `json:"resources,omitempty"`
-	// Default sizing preset used when `resources` is omitted. OpenSearch requires minimum 2Gi memory.
-	// +kubebuilder:default:="large"
-	ResourcesPreset ResourcesPreset `json:"resourcesPreset"`
-	// Persistent Volume Claim size available for application data.
-	// +kubebuilder:default:="10Gi"
-	Size resource.Quantity `json:"size"`
-	// StorageClass used to store the data.
-	// +kubebuilder:default:=""
-	StorageClass string `json:"storageClass"`
-	// Enable external access from outside the cluster.
-	// +kubebuilder:default:=false
-	External bool `json:"external"`
-	// How strictly to enforce pod distribution across nodes and zones.
-	// +kubebuilder:default:="soft"
-	TopologySpreadPolicy TopologySpreadPolicy `json:"topologySpreadPolicy"`
-	// OpenSearch major version to deploy.
-	// +kubebuilder:default:="v2"
-	Version Version `json:"version"`
-	// Container images used by the operator.
-	// +kubebuilder:default:={}
-	Images Images `json:"images"`
-	// Node roles configuration.
-	// +kubebuilder:default:={}
-	NodeRoles NodeRoles `json:"nodeRoles"`
-	// Custom OpenSearch users configuration map.
-	// +kubebuilder:default:={}
-	Users map[string]User `json:"users,omitempty"`
-	// OpenSearch Dashboards configuration.
-	// +kubebuilder:default:={}
-	Dashboards Dashboards `json:"dashboards"`
-}
-
-type Dashboards struct {
-	// Enable OpenSearch Dashboards deployment.
-	// +kubebuilder:default:=false
-	Enabled bool `json:"enabled"`
-	// Number of Dashboards replicas.
-	// +kubebuilder:default:=1
-	Replicas int `json:"replicas"`
-	// Explicit CPU and memory configuration for Dashboards.
-	// +kubebuilder:default:={}
-	Resources Resources `json:"resources,omitempty"`
-	// Default sizing preset for Dashboards.
-	// +kubebuilder:default:="medium"
-	ResourcesPreset ResourcesPreset `json:"resourcesPreset"`
-}
-
-type Images struct {
-	// OpenSearch image.
-	// +kubebuilder:default:=""
-	Opensearch string `json:"opensearch"`
-}
-
-type NodeRoles struct {
-	// Enable data role.
-	// +kubebuilder:default:=true
-	Data bool `json:"data"`
-	// Enable ingest role.
-	// +kubebuilder:default:=true
-	Ingest bool `json:"ingest"`
-	// Enable cluster_manager role.
-	// +kubebuilder:default:=true
-	Master bool `json:"master"`
-	// Enable machine learning role.
-	// +kubebuilder:default:=false
-	Ml bool `json:"ml"`
-}
-
-type Resources struct {
-	// CPU available to each node.
-	Cpu resource.Quantity `json:"cpu,omitempty"`
-	// Memory (RAM) available to each node.
-	Memory resource.Quantity `json:"memory,omitempty"`
-}
-
-type User struct {
-	// Password for the user (auto-generated if omitted).
-	Password string `json:"password,omitempty"`
-	// List of OpenSearch roles.
-	Roles []string `json:"roles,omitempty"`
-}
-
-// +kubebuilder:validation:Enum="nano";"micro";"small";"medium";"large";"xlarge";"2xlarge"
-type ResourcesPreset string
-
-// +kubebuilder:validation:Enum="soft";"hard"
-type TopologySpreadPolicy string
-
-// +kubebuilder:validation:Enum="v3";"v2";"v1"
-type Version string

api/apps/v1alpha1/opensearch/zz_generated.deepcopy.go

@@ -1,161 +0,0 @@
-//go:build !ignore_autogenerated
-
-/*
-Copyright 2025 The Cozystack Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-// Code generated by controller-gen. DO NOT EDIT.
-
-package opensearch
-
-import (
-	runtime "k8s.io/apimachinery/pkg/runtime"
-)
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *Config) DeepCopyInto(out *Config) {
-	*out = *in
-	out.TypeMeta = in.TypeMeta
-	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
-	in.Spec.DeepCopyInto(&out.Spec)
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Config.
-func (in *Config) DeepCopy() *Config {
-	if in == nil {
-		return nil
-	}
-	out := new(Config)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
-func (in *Config) DeepCopyObject() runtime.Object {
-	if c := in.DeepCopy(); c != nil {
-		return c
-	}
-	return nil
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *ConfigSpec) DeepCopyInto(out *ConfigSpec) {
-	*out = *in
-	in.Resources.DeepCopyInto(&out.Resources)
-	out.Size = in.Size.DeepCopy()
-	out.Images = in.Images
-	out.NodeRoles = in.NodeRoles
-	if in.Users != nil {
-		in, out := &in.Users, &out.Users
-		*out = make(map[string]User, len(*in))
-		for key, val := range *in {
-			(*out)[key] = *val.DeepCopy()
-		}
-	}
-	in.Dashboards.DeepCopyInto(&out.Dashboards)
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ConfigSpec.
-func (in *ConfigSpec) DeepCopy() *ConfigSpec {
-	if in == nil {
-		return nil
-	}
-	out := new(ConfigSpec)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *Dashboards) DeepCopyInto(out *Dashboards) {
-	*out = *in
-	in.Resources.DeepCopyInto(&out.Resources)
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Dashboards.
-func (in *Dashboards) DeepCopy() *Dashboards {
-	if in == nil {
-		return nil
-	}
-	out := new(Dashboards)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *Images) DeepCopyInto(out *Images) {
-	*out = *in
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Images.
-func (in *Images) DeepCopy() *Images {
-	if in == nil {
-		return nil
-	}
-	out := new(Images)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *NodeRoles) DeepCopyInto(out *NodeRoles) {
-	*out = *in
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new NodeRoles.
-func (in *NodeRoles) DeepCopy() *NodeRoles {
-	if in == nil {
-		return nil
-	}
-	out := new(NodeRoles)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *Resources) DeepCopyInto(out *Resources) {
-	*out = *in
-	out.Cpu = in.Cpu.DeepCopy()
-	out.Memory = in.Memory.DeepCopy()
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Resources.
-func (in *Resources) DeepCopy() *Resources {
-	if in == nil {
-		return nil
-	}
-	out := new(Resources)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *User) DeepCopyInto(out *User) {
-	*out = *in
-	if in.Roles != nil {
-		in, out := &in.Roles, &out.Roles
-		*out = make([]string, len(*in))
-		copy(*out, *in)
-	}
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new User.
-func (in *User) DeepCopy() *User {
-	if in == nil {
-		return nil
-	}
-	out := new(User)
-	in.DeepCopyInto(out)
-	return out
-}

api/apps/v1alpha1/postgresql/types.go

@@ -1,153 +0,0 @@
-// Code generated by values-gen. DO NOT EDIT.
-// +kubebuilder:object:generate=true
-// +groupName=apps.cozystack.io
-// +versionName=v1alpha1
-package postgresql
-
-import (
-	resource "k8s.io/apimachinery/pkg/api/resource"
-	"k8s.io/apimachinery/pkg/apis/meta/v1"
-)
-
-// +kubebuilder:object:root=true
-type Config struct {
-	v1.TypeMeta   `json:",inline"`
-	v1.ObjectMeta `json:"metadata,omitempty"`
-	Spec          ConfigSpec `json:"spec,omitempty"`
-}
-
-type ConfigSpec struct {
-	// Number of Postgres replicas.
-	// +kubebuilder:default:=2
-	Replicas int `json:"replicas"`
-	// Explicit CPU and memory configuration for each PostgreSQL replica. When omitted, the preset defined in `resourcesPreset` is applied.
-	// +kubebuilder:default:={}
-	Resources Resources `json:"resources,omitempty"`
-	// Default sizing preset used when `resources` is omitted.
-	// +kubebuilder:default:="micro"
-	ResourcesPreset ResourcesPreset `json:"resourcesPreset"`
-	// Persistent Volume Claim size available for application data.
-	// +kubebuilder:default:="10Gi"
-	Size resource.Quantity `json:"size"`
-	// StorageClass used to store the data.
-	// +kubebuilder:default:=""
-	StorageClass string `json:"storageClass"`
-	// Enable external access from outside the cluster.
-	// +kubebuilder:default:=false
-	External bool `json:"external"`
-	// PostgreSQL major version to deploy
-	// +kubebuilder:default:="v18"
-	Version Version `json:"version"`
-	// PostgreSQL server configuration.
-	// +kubebuilder:default:={}
-	Postgresql PostgreSQL `json:"postgresql"`
-	// Quorum configuration for synchronous replication.
-	// +kubebuilder:default:={}
-	Quorum Quorum `json:"quorum"`
-	// Users configuration map.
-	// +kubebuilder:default:={}
-	Users map[string]User `json:"users,omitempty"`
-	// Databases configuration map.
-	// +kubebuilder:default:={}
-	Databases map[string]Database `json:"databases,omitempty"`
-	// Backup configuration.
-	// +kubebuilder:default:={}
-	Backup Backup `json:"backup"`
-	// Bootstrap configuration.
-	// +kubebuilder:default:={}
-	Bootstrap Bootstrap `json:"bootstrap"`
-}
-
-type Backup struct {
-	// Destination path for backups (e.g. s3://bucket/path/).
-	// +kubebuilder:default:="s3://bucket/path/to/folder/"
-	DestinationPath string `json:"destinationPath,omitempty"`
-	// Enable regular backups.
-	// +kubebuilder:default:=false
-	Enabled bool `json:"enabled"`
-	// S3 endpoint URL for uploads.
-	// +kubebuilder:default:="http://minio-gateway-service:9000"
-	EndpointURL string `json:"endpointURL,omitempty"`
-	// Retention policy (e.g. "30d").
-	// +kubebuilder:default:="30d"
-	RetentionPolicy string `json:"retentionPolicy,omitempty"`
-	// Access key for S3 authentication.
-	// +kubebuilder:default:="<your-access-key>"
-	S3AccessKey string `json:"s3AccessKey,omitempty"`
-	// Secret key for S3 authentication.
-	// +kubebuilder:default:="<your-secret-key>"
-	S3SecretKey string `json:"s3SecretKey,omitempty"`
-	// Cron schedule for automated backups.
-	// +kubebuilder:default:="0 2 * * * *"
-	Schedule string `json:"schedule,omitempty"`
-}
-
-type Bootstrap struct {
-	// Whether to restore from a backup.
-	// +kubebuilder:default:=false
-	Enabled bool `json:"enabled"`
-	// Previous cluster name before deletion.
-	// +kubebuilder:default:=""
-	OldName string `json:"oldName"`
-	// Timestamp (RFC3339) for point-in-time recovery; empty means latest.
-	// +kubebuilder:default:=""
-	RecoveryTime string `json:"recoveryTime,omitempty"`
-	// Barman server name (S3 path prefix) used by the original cluster when writing backups. Set this only when the original cluster had an explicit barmanObjectStore.serverName that differed from its Kubernetes resource name.
-	// +kubebuilder:default:=""
-	ServerName string `json:"serverName,omitempty"`
-}
-
-type Database struct {
-	// List of enabled PostgreSQL extensions.
-	Extensions []string `json:"extensions,omitempty"`
-	// Roles assigned to users.
-	Roles DatabaseRoles `json:"roles,omitempty"`
-}
-
-type DatabaseRoles struct {
-	// List of users with admin privileges.
-	Admin []string `json:"admin,omitempty"`
-	// List of users with read-only privileges.
-	Readonly []string `json:"readonly,omitempty"`
-}
-
-type PostgreSQL struct {
-	// PostgreSQL server parameters.
-	// +kubebuilder:default:={}
-	Parameters PostgreSQLParameters `json:"parameters,omitempty"`
-}
-
-type PostgreSQLParameters struct {
-	// Maximum number of concurrent connections to the database server.
-	// +kubebuilder:default:=100
-	MaxConnections int `json:"max_connections,omitempty"`
-}
-
-type Quorum struct {
-	// Maximum number of synchronous replicas allowed (must be less than total replicas).
-	// +kubebuilder:default:=0
-	MaxSyncReplicas int `json:"maxSyncReplicas"`
-	// Minimum number of synchronous replicas required for commit.
-	// +kubebuilder:default:=0
-	MinSyncReplicas int `json:"minSyncReplicas"`
-}
-
-type Resources struct {
-	// CPU available to each replica.
-	Cpu resource.Quantity `json:"cpu,omitempty"`
-	// Memory (RAM) available to each replica.
-	Memory resource.Quantity `json:"memory,omitempty"`
-}
-
-type User struct {
-	// Password for the user.
-	Password string `json:"password,omitempty"`
-	// Whether the user has replication privileges.
-	Replication bool `json:"replication,omitempty"`
-}
-
-// +kubebuilder:validation:Enum="nano";"micro";"small";"medium";"large";"xlarge";"2xlarge"
-type ResourcesPreset string
-
-// +kubebuilder:validation:Enum="v18";"v17";"v16";"v15";"v14";"v13"
-type Version string

api/apps/v1alpha1/postgresql/zz_generated.deepcopy.go

@@ -1,240 +0,0 @@
-//go:build !ignore_autogenerated
-
-/*
-Copyright 2025 The Cozystack Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-// Code generated by controller-gen. DO NOT EDIT.
-
-package postgresql
-
-import (
-	runtime "k8s.io/apimachinery/pkg/runtime"
-)
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *Backup) DeepCopyInto(out *Backup) {
-	*out = *in
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Backup.
-func (in *Backup) DeepCopy() *Backup {
-	if in == nil {
-		return nil
-	}
-	out := new(Backup)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *Bootstrap) DeepCopyInto(out *Bootstrap) {
-	*out = *in
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Bootstrap.
-func (in *Bootstrap) DeepCopy() *Bootstrap {
-	if in == nil {
-		return nil
-	}
-	out := new(Bootstrap)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *Config) DeepCopyInto(out *Config) {
-	*out = *in
-	out.TypeMeta = in.TypeMeta
-	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
-	in.Spec.DeepCopyInto(&out.Spec)
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Config.
-func (in *Config) DeepCopy() *Config {
-	if in == nil {
-		return nil
-	}
-	out := new(Config)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
-func (in *Config) DeepCopyObject() runtime.Object {
-	if c := in.DeepCopy(); c != nil {
-		return c
-	}
-	return nil
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *ConfigSpec) DeepCopyInto(out *ConfigSpec) {
-	*out = *in
-	in.Resources.DeepCopyInto(&out.Resources)
-	out.Size = in.Size.DeepCopy()
-	out.Postgresql = in.Postgresql
-	out.Quorum = in.Quorum
-	if in.Users != nil {
-		in, out := &in.Users, &out.Users
-		*out = make(map[string]User, len(*in))
-		for key, val := range *in {
-			(*out)[key] = val
-		}
-	}
-	if in.Databases != nil {
-		in, out := &in.Databases, &out.Databases
-		*out = make(map[string]Database, len(*in))
-		for key, val := range *in {
-			(*out)[key] = *val.DeepCopy()
-		}
-	}
-	out.Backup = in.Backup
-	out.Bootstrap = in.Bootstrap
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ConfigSpec.
-func (in *ConfigSpec) DeepCopy() *ConfigSpec {
-	if in == nil {
-		return nil
-	}
-	out := new(ConfigSpec)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *Database) DeepCopyInto(out *Database) {
-	*out = *in
-	if in.Extensions != nil {
-		in, out := &in.Extensions, &out.Extensions
-		*out = make([]string, len(*in))
-		copy(*out, *in)
-	}
-	in.Roles.DeepCopyInto(&out.Roles)
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Database.
-func (in *Database) DeepCopy() *Database {
-	if in == nil {
-		return nil
-	}
-	out := new(Database)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *DatabaseRoles) DeepCopyInto(out *DatabaseRoles) {
-	*out = *in
-	if in.Admin != nil {
-		in, out := &in.Admin, &out.Admin
-		*out = make([]string, len(*in))
-		copy(*out, *in)
-	}
-	if in.Readonly != nil {
-		in, out := &in.Readonly, &out.Readonly
-		*out = make([]string, len(*in))
-		copy(*out, *in)
-	}
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new DatabaseRoles.
-func (in *DatabaseRoles) DeepCopy() *DatabaseRoles {
-	if in == nil {
-		return nil
-	}
-	out := new(DatabaseRoles)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *PostgreSQL) DeepCopyInto(out *PostgreSQL) {
-	*out = *in
-	out.Parameters = in.Parameters
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PostgreSQL.
-func (in *PostgreSQL) DeepCopy() *PostgreSQL {
-	if in == nil {
-		return nil
-	}
-	out := new(PostgreSQL)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *PostgreSQLParameters) DeepCopyInto(out *PostgreSQLParameters) {
-	*out = *in
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PostgreSQLParameters.
-func (in *PostgreSQLParameters) DeepCopy() *PostgreSQLParameters {
-	if in == nil {
-		return nil
-	}
-	out := new(PostgreSQLParameters)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *Quorum) DeepCopyInto(out *Quorum) {
-	*out = *in
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Quorum.
-func (in *Quorum) DeepCopy() *Quorum {
-	if in == nil {
-		return nil
-	}
-	out := new(Quorum)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *Resources) DeepCopyInto(out *Resources) {
-	*out = *in
-	out.Cpu = in.Cpu.DeepCopy()
-	out.Memory = in.Memory.DeepCopy()
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Resources.
-func (in *Resources) DeepCopy() *Resources {
-	if in == nil {
-		return nil
-	}
-	out := new(Resources)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *User) DeepCopyInto(out *User) {
-	*out = *in
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new User.
-func (in *User) DeepCopy() *User {
-	if in == nil {
-		return nil
-	}
-	out := new(User)
-	in.DeepCopyInto(out)
-	return out
-}

api/apps/v1alpha1/qdrant/types.go

@@ -1,48 +0,0 @@
-// Code generated by values-gen. DO NOT EDIT.
-// +kubebuilder:object:generate=true
-// +groupName=apps.cozystack.io
-// +versionName=v1alpha1
-package qdrant
-
-import (
-	resource "k8s.io/apimachinery/pkg/api/resource"
-	"k8s.io/apimachinery/pkg/apis/meta/v1"
-)
-
-// +kubebuilder:object:root=true
-type Config struct {
-	v1.TypeMeta   `json:",inline"`
-	v1.ObjectMeta `json:"metadata,omitempty"`
-	Spec          ConfigSpec `json:"spec,omitempty"`
-}
-
-type ConfigSpec struct {
-	// Number of Qdrant replicas. Cluster mode is automatically enabled when replicas > 1.
-	// +kubebuilder:default:=1
-	Replicas int `json:"replicas"`
-	// Explicit CPU and memory configuration for each Qdrant replica. When omitted, the preset defined in `resourcesPreset` is applied.
-	// +kubebuilder:default:={}
-	Resources Resources `json:"resources,omitempty"`
-	// Default sizing preset used when `resources` is omitted.
-	// +kubebuilder:default:="small"
-	ResourcesPreset ResourcesPreset `json:"resourcesPreset"`
-	// Persistent Volume Claim size available for vector data storage.
-	// +kubebuilder:default:="10Gi"
-	Size resource.Quantity `json:"size"`
-	// StorageClass used to store the data.
-	// +kubebuilder:default:=""
-	StorageClass string `json:"storageClass"`
-	// Enable external access from outside the cluster.
-	// +kubebuilder:default:=false
-	External bool `json:"external"`
-}
-
-type Resources struct {
-	// CPU available to each replica.
-	Cpu resource.Quantity `json:"cpu,omitempty"`
-	// Memory (RAM) available to each replica.
-	Memory resource.Quantity `json:"memory,omitempty"`
-}
-
-// +kubebuilder:validation:Enum="nano";"micro";"small";"medium";"large";"xlarge";"2xlarge"
-type ResourcesPreset string

api/apps/v1alpha1/qdrant/zz_generated.deepcopy.go

@@ -1,85 +0,0 @@
-//go:build !ignore_autogenerated
-
-/*
-Copyright 2025 The Cozystack Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-// Code generated by controller-gen. DO NOT EDIT.
-
-package qdrant
-
-import (
-	runtime "k8s.io/apimachinery/pkg/runtime"
-)
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *Config) DeepCopyInto(out *Config) {
-	*out = *in
-	out.TypeMeta = in.TypeMeta
-	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
-	in.Spec.DeepCopyInto(&out.Spec)
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Config.
-func (in *Config) DeepCopy() *Config {
-	if in == nil {
-		return nil
-	}
-	out := new(Config)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
-func (in *Config) DeepCopyObject() runtime.Object {
-	if c := in.DeepCopy(); c != nil {
-		return c
-	}
-	return nil
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *ConfigSpec) DeepCopyInto(out *ConfigSpec) {
-	*out = *in
-	in.Resources.DeepCopyInto(&out.Resources)
-	out.Size = in.Size.DeepCopy()
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ConfigSpec.
-func (in *ConfigSpec) DeepCopy() *ConfigSpec {
-	if in == nil {
-		return nil
-	}
-	out := new(ConfigSpec)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *Resources) DeepCopyInto(out *Resources) {
-	*out = *in
-	out.Cpu = in.Cpu.DeepCopy()
-	out.Memory = in.Memory.DeepCopy()
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Resources.
-func (in *Resources) DeepCopy() *Resources {
-	if in == nil {
-		return nil
-	}
-	out := new(Resources)
-	in.DeepCopyInto(out)
-	return out
-}

api/apps/v1alpha1/rabbitmq/types.go

@@ -1,77 +0,0 @@
-// Code generated by values-gen. DO NOT EDIT.
-// +kubebuilder:object:generate=true
-// +groupName=apps.cozystack.io
-// +versionName=v1alpha1
-package rabbitmq
-
-import (
-	resource "k8s.io/apimachinery/pkg/api/resource"
-	"k8s.io/apimachinery/pkg/apis/meta/v1"
-)
-
-// +kubebuilder:object:root=true
-type Config struct {
-	v1.TypeMeta   `json:",inline"`
-	v1.ObjectMeta `json:"metadata,omitempty"`
-	Spec          ConfigSpec `json:"spec,omitempty"`
-}
-
-type ConfigSpec struct {
-	// Number of RabbitMQ replicas.
-	// +kubebuilder:default:=3
-	Replicas int `json:"replicas"`
-	// Explicit CPU and memory configuration for each RabbitMQ replica. When omitted, the preset defined in `resourcesPreset` is applied.
-	// +kubebuilder:default:={}
-	Resources Resources `json:"resources,omitempty"`
-	// Default sizing preset used when `resources` is omitted.
-	// +kubebuilder:default:="nano"
-	ResourcesPreset ResourcesPreset `json:"resourcesPreset"`
-	// Persistent Volume Claim size available for application data.
-	// +kubebuilder:default:="10Gi"
-	Size resource.Quantity `json:"size"`
-	// StorageClass used to store the data.
-	// +kubebuilder:default:=""
-	StorageClass string `json:"storageClass"`
-	// Enable external access from outside the cluster.
-	// +kubebuilder:default:=false
-	External bool `json:"external"`
-	// RabbitMQ major.minor version to deploy
-	// +kubebuilder:default:="v4.2"
-	Version Version `json:"version"`
-	// Users configuration map.
-	// +kubebuilder:default:={}
-	Users map[string]User `json:"users,omitempty"`
-	// Virtual hosts configuration map.
-	// +kubebuilder:default:={}
-	Vhosts map[string]Vhost `json:"vhosts,omitempty"`
-}
-
-type Resources struct {
-	// CPU available to each replica.
-	Cpu resource.Quantity `json:"cpu,omitempty"`
-	// Memory (RAM) available to each replica.
-	Memory resource.Quantity `json:"memory,omitempty"`
-}
-
-type Roles struct {
-	// List of admin users.
-	Admin []string `json:"admin,omitempty"`
-	// List of readonly users.
-	Readonly []string `json:"readonly,omitempty"`
-}
-
-type User struct {
-	// Password for the user.
-	Password string `json:"password,omitempty"`
-}
-
-type Vhost struct {
-	// Virtual host roles list.
-	Roles Roles `json:"roles"`
-}
-
-// +kubebuilder:validation:Enum="nano";"micro";"small";"medium";"large";"xlarge";"2xlarge"
-type ResourcesPreset string
-
-// +kubebuilder:validation:Enum="v4.2";"v4.1";"v4.0";"v3.13"
-type Version string

api/apps/v1alpha1/rabbitmq/zz_generated.deepcopy.go

@@ -1,155 +0,0 @@
-//go:build !ignore_autogenerated
-
-/*
-Copyright 2025 The Cozystack Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-// Code generated by controller-gen. DO NOT EDIT.
-
-package rabbitmq
-
-import (
-	runtime "k8s.io/apimachinery/pkg/runtime"
-)
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *Config) DeepCopyInto(out *Config) {
-	*out = *in
-	out.TypeMeta = in.TypeMeta
-	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
-	in.Spec.DeepCopyInto(&out.Spec)
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Config.
-func (in *Config) DeepCopy() *Config {
-	if in == nil {
-		return nil
-	}
-	out := new(Config)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
-func (in *Config) DeepCopyObject() runtime.Object {
-	if c := in.DeepCopy(); c != nil {
-		return c
-	}
-	return nil
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *ConfigSpec) DeepCopyInto(out *ConfigSpec) {
-	*out = *in
-	in.Resources.DeepCopyInto(&out.Resources)
-	out.Size = in.Size.DeepCopy()
-	if in.Users != nil {
-		in, out := &in.Users, &out.Users
-		*out = make(map[string]User, len(*in))
-		for key, val := range *in {
-			(*out)[key] = val
-		}
-	}
-	if in.Vhosts != nil {
-		in, out := &in.Vhosts, &out.Vhosts
-		*out = make(map[string]Vhost, len(*in))
-		for key, val := range *in {
-			(*out)[key] = *val.DeepCopy()
-		}
-	}
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ConfigSpec.
-func (in *ConfigSpec) DeepCopy() *ConfigSpec {
-	if in == nil {
-		return nil
-	}
-	out := new(ConfigSpec)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *Resources) DeepCopyInto(out *Resources) {
-	*out = *in
-	out.Cpu = in.Cpu.DeepCopy()
-	out.Memory = in.Memory.DeepCopy()
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Resources.
-func (in *Resources) DeepCopy() *Resources {
-	if in == nil {
-		return nil
-	}
-	out := new(Resources)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *Roles) DeepCopyInto(out *Roles) {
-	*out = *in
-	if in.Admin != nil {
-		in, out := &in.Admin, &out.Admin
-		*out = make([]string, len(*in))
-		copy(*out, *in)
-	}
-	if in.Readonly != nil {
-		in, out := &in.Readonly, &out.Readonly
-		*out = make([]string, len(*in))
-		copy(*out, *in)
-	}
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Roles.
-func (in *Roles) DeepCopy() *Roles {
-	if in == nil {
-		return nil
-	}
-	out := new(Roles)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *User) DeepCopyInto(out *User) {
-	*out = *in
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new User.
-func (in *User) DeepCopy() *User {
-	if in == nil {
-		return nil
-	}
-	out := new(User)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *Vhost) DeepCopyInto(out *Vhost) {
-	*out = *in
-	in.Roles.DeepCopyInto(&out.Roles)
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Vhost.
-func (in *Vhost) DeepCopy() *Vhost {
-	if in == nil {
-		return nil
-	}
-	out := new(Vhost)
-	in.DeepCopyInto(out)
-	return out
-}

api/apps/v1alpha1/redis/types.go

@@ -1,57 +0,0 @@
-// Code generated by values-gen. DO NOT EDIT.
-// +kubebuilder:object:generate=true
-// +groupName=apps.cozystack.io
-// +versionName=v1alpha1
-package redis
-
-import (
-	resource "k8s.io/apimachinery/pkg/api/resource"
-	"k8s.io/apimachinery/pkg/apis/meta/v1"
-)
-
-// +kubebuilder:object:root=true
-type Config struct {
-	v1.TypeMeta   `json:",inline"`
-	v1.ObjectMeta `json:"metadata,omitempty"`
-	Spec          ConfigSpec `json:"spec,omitempty"`
-}
-
-type ConfigSpec struct {
-	// Number of Redis replicas.
-	// +kubebuilder:default:=2
-	Replicas int `json:"replicas"`
-	// Explicit CPU and memory configuration for each Redis replica. When omitted, the preset defined in `resourcesPreset` is applied.
-	// +kubebuilder:default:={}
-	Resources Resources `json:"resources,omitempty"`
-	// Default sizing preset used when `resources` is omitted.
-	// +kubebuilder:default:="nano"
-	ResourcesPreset ResourcesPreset `json:"resourcesPreset"`
-	// Persistent Volume Claim size available for application data.
-	// +kubebuilder:default:="1Gi"
-	Size resource.Quantity `json:"size"`
-	// StorageClass used to store the data.
-	// +kubebuilder:default:=""
-	StorageClass string `json:"storageClass"`
-	// Enable external access from outside the cluster.
-	// +kubebuilder:default:=false
-	External bool `json:"external"`
-	// Redis major version to deploy
-	// +kubebuilder:default:="v8"
-	Version Version `json:"version"`
-	// Enable password generation.
-	// +kubebuilder:default:=true
-	AuthEnabled bool `json:"authEnabled"`
-}
-
-type Resources struct {
-	// CPU available to each replica.
-	Cpu resource.Quantity `json:"cpu,omitempty"`
-	// Memory (RAM) available to each replica.
-	Memory resource.Quantity `json:"memory,omitempty"`
-}
-
-// +kubebuilder:validation:Enum="nano";"micro";"small";"medium";"large";"xlarge";"2xlarge"
-type ResourcesPreset string
-
-// +kubebuilder:validation:Enum="v8";"v7"
-type Version string

api/apps/v1alpha1/redis/zz_generated.deepcopy.go

@@ -1,85 +0,0 @@
-//go:build !ignore_autogenerated
-
-/*
-Copyright 2025 The Cozystack Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-// Code generated by controller-gen. DO NOT EDIT.
-
-package redis
-
-import (
-	runtime "k8s.io/apimachinery/pkg/runtime"
-)
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *Config) DeepCopyInto(out *Config) {
-	*out = *in
-	out.TypeMeta = in.TypeMeta
-	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
-	in.Spec.DeepCopyInto(&out.Spec)
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Config.
-func (in *Config) DeepCopy() *Config {
-	if in == nil {
-		return nil
-	}
-	out := new(Config)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
-func (in *Config) DeepCopyObject() runtime.Object {
-	if c := in.DeepCopy(); c != nil {
-		return c
-	}
-	return nil
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *ConfigSpec) DeepCopyInto(out *ConfigSpec) {
-	*out = *in
-	in.Resources.DeepCopyInto(&out.Resources)
-	out.Size = in.Size.DeepCopy()
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ConfigSpec.
-func (in *ConfigSpec) DeepCopy() *ConfigSpec {
-	if in == nil {
-		return nil
-	}
-	out := new(ConfigSpec)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *Resources) DeepCopyInto(out *Resources) {
-	*out = *in
-	out.Cpu = in.Cpu.DeepCopy()
-	out.Memory = in.Memory.DeepCopy()
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Resources.
-func (in *Resources) DeepCopy() *Resources {
-	if in == nil {
-		return nil
-	}
-	out := new(Resources)
-	in.DeepCopyInto(out)
-	return out
-}

api/apps/v1alpha1/tcpbalancer/types.go

@@ -1,75 +0,0 @@
-// Code generated by values-gen. DO NOT EDIT.
-// +kubebuilder:object:generate=true
-// +groupName=apps.cozystack.io
-// +versionName=v1alpha1
-package tcpbalancer
-
-import (
-	resource "k8s.io/apimachinery/pkg/api/resource"
-	"k8s.io/apimachinery/pkg/apis/meta/v1"
-)
-
-// +kubebuilder:object:root=true
-type Config struct {
-	v1.TypeMeta   `json:",inline"`
-	v1.ObjectMeta `json:"metadata,omitempty"`
-	Spec          ConfigSpec `json:"spec,omitempty"`
-}
-
-type ConfigSpec struct {
-	// Number of HAProxy replicas.
-	// +kubebuilder:default:=2
-	Replicas int `json:"replicas"`
-	// Explicit CPU and memory configuration for each TCP Balancer replica. When omitted, the preset defined in `resourcesPreset` is applied.
-	// +kubebuilder:default:={}
-	Resources Resources `json:"resources,omitempty"`
-	// Default sizing preset used when `resources` is omitted.
-	// +kubebuilder:default:="nano"
-	ResourcesPreset ResourcesPreset `json:"resourcesPreset"`
-	// Enable external access from outside the cluster.
-	// +kubebuilder:default:=false
-	External bool `json:"external"`
-	// HTTP and HTTPS configuration.
-	// +kubebuilder:default:={}
-	HttpAndHttps HttpAndHttps `json:"httpAndHttps"`
-	// Secure HTTP by whitelisting client networks (default: false).
-	// +kubebuilder:default:=false
-	WhitelistHTTP bool `json:"whitelistHTTP"`
-	// List of allowed client networks.
-	// +kubebuilder:default:={}
-	Whitelist []string `json:"whitelist,omitempty"`
-}
-
-type HttpAndHttps struct {
-	// Endpoint addresses list.
-	// +kubebuilder:default:={}
-	Endpoints []string `json:"endpoints,omitempty"`
-	// Mode for balancer.
-	// +kubebuilder:default:="tcp"
-	Mode Mode `json:"mode"`
-	// Target ports configuration.
-	// +kubebuilder:default:={}
-	TargetPorts TargetPorts `json:"targetPorts"`
-}
-
-type Resources struct {
-	// CPU available to each replica.
-	Cpu resource.Quantity `json:"cpu,omitempty"`
-	// Memory (RAM) available to each replica.
-	Memory resource.Quantity `json:"memory,omitempty"`
-}
-
-type TargetPorts struct {
-	// HTTP port number.
-	// +kubebuilder:default:=80
-	Http int `json:"http"`
-	// HTTPS port number.
-	// +kubebuilder:default:=443
-	Https int `json:"https"`
-}
-
-// +kubebuilder:validation:Enum="tcp";"tcp-with-proxy"
-type Mode string
-
-// +kubebuilder:validation:Enum="nano";"micro";"small";"medium";"large";"xlarge";"2xlarge"
-type ResourcesPreset string

api/apps/v1alpha1/tcpbalancer/zz_generated.deepcopy.go

@@ -1,126 +0,0 @@
-//go:build !ignore_autogenerated
-
-/*
-Copyright 2025 The Cozystack Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-// Code generated by controller-gen. DO NOT EDIT.
-
-package tcpbalancer
-
-import (
-	runtime "k8s.io/apimachinery/pkg/runtime"
-)
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *Config) DeepCopyInto(out *Config) {
-	*out = *in
-	out.TypeMeta = in.TypeMeta
-	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
-	in.Spec.DeepCopyInto(&out.Spec)
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Config.
-func (in *Config) DeepCopy() *Config {
-	if in == nil {
-		return nil
-	}
-	out := new(Config)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
-func (in *Config) DeepCopyObject() runtime.Object {
-	if c := in.DeepCopy(); c != nil {
-		return c
-	}
-	return nil
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *ConfigSpec) DeepCopyInto(out *ConfigSpec) {
-	*out = *in
-	in.Resources.DeepCopyInto(&out.Resources)
-	in.HttpAndHttps.DeepCopyInto(&out.HttpAndHttps)
-	if in.Whitelist != nil {
-		in, out := &in.Whitelist, &out.Whitelist
-		*out = make([]string, len(*in))
-		copy(*out, *in)
-	}
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ConfigSpec.
-func (in *ConfigSpec) DeepCopy() *ConfigSpec {
-	if in == nil {
-		return nil
-	}
-	out := new(ConfigSpec)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *HttpAndHttps) DeepCopyInto(out *HttpAndHttps) {
-	*out = *in
-	if in.Endpoints != nil {
-		in, out := &in.Endpoints, &out.Endpoints
-		*out = make([]string, len(*in))
-		copy(*out, *in)
-	}
-	out.TargetPorts = in.TargetPorts
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new HttpAndHttps.
-func (in *HttpAndHttps) DeepCopy() *HttpAndHttps {
-	if in == nil {
-		return nil
-	}
-	out := new(HttpAndHttps)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *Resources) DeepCopyInto(out *Resources) {
-	*out = *in
-	out.Cpu = in.Cpu.DeepCopy()
-	out.Memory = in.Memory.DeepCopy()
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Resources.
-func (in *Resources) DeepCopy() *Resources {
-	if in == nil {
-		return nil
-	}
-	out := new(Resources)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *TargetPorts) DeepCopyInto(out *TargetPorts) {
-	*out = *in
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TargetPorts.
-func (in *TargetPorts) DeepCopy() *TargetPorts {
-	if in == nil {
-		return nil
-	}
-	out := new(TargetPorts)
-	in.DeepCopyInto(out)
-	return out
-}

api/apps/v1alpha1/tenant/types.go

@@ -1,41 +0,0 @@
-// Code generated by values-gen. DO NOT EDIT.
-// +kubebuilder:object:generate=true
-// +groupName=apps.cozystack.io
-// +versionName=v1alpha1
-package tenant
-
-import (
-	resource "k8s.io/apimachinery/pkg/api/resource"
-	"k8s.io/apimachinery/pkg/apis/meta/v1"
-)
-
-// +kubebuilder:object:root=true
-type Config struct {
-	v1.TypeMeta   `json:",inline"`
-	v1.ObjectMeta `json:"metadata,omitempty"`
-	Spec          ConfigSpec `json:"spec,omitempty"`
-}
-
-type ConfigSpec struct {
-	// The hostname used to access tenant services (defaults to using the tenant name as a subdomain for its parent tenant host).
-	// +kubebuilder:default:=""
-	Host string `json:"host,omitempty"`
-	// Deploy own Etcd cluster.
-	// +kubebuilder:default:=false
-	Etcd bool `json:"etcd"`
-	// Deploy own Monitoring Stack.
-	// +kubebuilder:default:=false
-	Monitoring bool `json:"monitoring"`
-	// Deploy own Ingress Controller.
-	// +kubebuilder:default:=false
-	Ingress bool `json:"ingress"`
-	// Deploy own SeaweedFS.
-	// +kubebuilder:default:=false
-	Seaweedfs bool `json:"seaweedfs"`
-	// The name of a SchedulingClass CR to apply scheduling constraints for this tenant's workloads.
-	// +kubebuilder:default:=""
-	SchedulingClass string `json:"schedulingClass,omitempty"`
-	// Define resource quotas for the tenant.
-	// +kubebuilder:default:={}
-	ResourceQuotas map[string]resource.Quantity `json:"resourceQuotas,omitempty"`
-}

api/apps/v1alpha1/tenant/zz_generated.deepcopy.go

@@ -1,74 +0,0 @@
-//go:build !ignore_autogenerated
-
-/*
-Copyright 2025 The Cozystack Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-// Code generated by controller-gen. DO NOT EDIT.
-
-package tenant
-
-import (
-	"k8s.io/apimachinery/pkg/api/resource"
-	runtime "k8s.io/apimachinery/pkg/runtime"
-)
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *Config) DeepCopyInto(out *Config) {
-	*out = *in
-	out.TypeMeta = in.TypeMeta
-	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
-	in.Spec.DeepCopyInto(&out.Spec)
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Config.
-func (in *Config) DeepCopy() *Config {
-	if in == nil {
-		return nil
-	}
-	out := new(Config)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
-func (in *Config) DeepCopyObject() runtime.Object {
-	if c := in.DeepCopy(); c != nil {
-		return c
-	}
-	return nil
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *ConfigSpec) DeepCopyInto(out *ConfigSpec) {
-	*out = *in
-	if in.ResourceQuotas != nil {
-		in, out := &in.ResourceQuotas, &out.ResourceQuotas
-		*out = make(map[string]resource.Quantity, len(*in))
-		for key, val := range *in {
-			(*out)[key] = val.DeepCopy()
-		}
-	}
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ConfigSpec.
-func (in *ConfigSpec) DeepCopy() *ConfigSpec {
-	if in == nil {
-		return nil
-	}
-	out := new(ConfigSpec)
-	in.DeepCopyInto(out)
-	return out
-}

api/apps/v1alpha1/vmdisk/types.go

@@ -1,61 +0,0 @@
-// Code generated by values-gen. DO NOT EDIT.
-// +kubebuilder:object:generate=true
-// +groupName=apps.cozystack.io
-// +versionName=v1alpha1
-package vmdisk
-
-import (
-	resource "k8s.io/apimachinery/pkg/api/resource"
-	"k8s.io/apimachinery/pkg/apis/meta/v1"
-)
-
-// +kubebuilder:object:root=true
-type Config struct {
-	v1.TypeMeta   `json:",inline"`
-	v1.ObjectMeta `json:"metadata,omitempty"`
-	Spec          ConfigSpec `json:"spec,omitempty"`
-}
-
-type ConfigSpec struct {
-	// The source image location used to create a disk.
-	// +kubebuilder:default:={}
-	Source Source `json:"source"`
-	// Defines if disk should be considered optical.
-	// +kubebuilder:default:=false
-	Optical bool `json:"optical"`
-	// The size of the disk allocated for the virtual machine.
-	// +kubebuilder:default:="5Gi"
-	Storage resource.Quantity `json:"storage"`
-	// StorageClass used to store the data.
-	// +kubebuilder:default:="replicated"
-	StorageClass string `json:"storageClass"`
-}
-
-type Source struct {
-	// Clone an existing vm-disk.
-	Disk *SourceDisk `json:"disk,omitempty"`
-	// Download image from an HTTP source.
-	Http *SourceHTTP `json:"http,omitempty"`
-	// Use image by name from default collection.
-	Image *SourceImage `json:"image,omitempty"`
-	// Upload local image.
-	Upload *SourceUpload `json:"upload,omitempty"`
-}
-
-type SourceDisk struct {
-	// Name of the vm-disk to clone.
-	Name string `json:"name"`
-}
-
-type SourceHTTP struct {
-	// URL to download the image.
-	Url string `json:"url"`
-}
-
-type SourceImage struct {
-	// Name of the image to use.
-	Name string `json:"name"`
-}
-
-type SourceUpload struct {
-}

api/apps/v1alpha1/vmdisk/zz_generated.deepcopy.go

@@ -1,163 +0,0 @@
-//go:build !ignore_autogenerated
-
-/*
-Copyright 2025 The Cozystack Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-// Code generated by controller-gen. DO NOT EDIT.
-
-package vmdisk
-
-import (
-	runtime "k8s.io/apimachinery/pkg/runtime"
-)
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *Config) DeepCopyInto(out *Config) {
-	*out = *in
-	out.TypeMeta = in.TypeMeta
-	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
-	in.Spec.DeepCopyInto(&out.Spec)
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Config.
-func (in *Config) DeepCopy() *Config {
-	if in == nil {
-		return nil
-	}
-	out := new(Config)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
-func (in *Config) DeepCopyObject() runtime.Object {
-	if c := in.DeepCopy(); c != nil {
-		return c
-	}
-	return nil
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *ConfigSpec) DeepCopyInto(out *ConfigSpec) {
-	*out = *in
-	in.Source.DeepCopyInto(&out.Source)
-	out.Storage = in.Storage.DeepCopy()
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ConfigSpec.
-func (in *ConfigSpec) DeepCopy() *ConfigSpec {
-	if in == nil {
-		return nil
-	}
-	out := new(ConfigSpec)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *Source) DeepCopyInto(out *Source) {
-	*out = *in
-	if in.Disk != nil {
-		in, out := &in.Disk, &out.Disk
-		*out = new(SourceDisk)
-		**out = **in
-	}
-	if in.Http != nil {
-		in, out := &in.Http, &out.Http
-		*out = new(SourceHTTP)
-		**out = **in
-	}
-	if in.Image != nil {
-		in, out := &in.Image, &out.Image
-		*out = new(SourceImage)
-		**out = **in
-	}
-	if in.Upload != nil {
-		in, out := &in.Upload, &out.Upload
-		*out = new(SourceUpload)
-		**out = **in
-	}
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Source.
-func (in *Source) DeepCopy() *Source {
-	if in == nil {
-		return nil
-	}
-	out := new(Source)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *SourceDisk) DeepCopyInto(out *SourceDisk) {
-	*out = *in
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SourceDisk.
-func (in *SourceDisk) DeepCopy() *SourceDisk {
-	if in == nil {
-		return nil
-	}
-	out := new(SourceDisk)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *SourceHTTP) DeepCopyInto(out *SourceHTTP) {
-	*out = *in
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SourceHTTP.
-func (in *SourceHTTP) DeepCopy() *SourceHTTP {
-	if in == nil {
-		return nil
-	}
-	out := new(SourceHTTP)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *SourceImage) DeepCopyInto(out *SourceImage) {
-	*out = *in
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SourceImage.
-func (in *SourceImage) DeepCopy() *SourceImage {
-	if in == nil {
-		return nil
-	}
-	out := new(SourceImage)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *SourceUpload) DeepCopyInto(out *SourceUpload) {
-	*out = *in
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SourceUpload.
-func (in *SourceUpload) DeepCopy() *SourceUpload {
-	if in == nil {
-		return nil
-	}
-	out := new(SourceUpload)
-	in.DeepCopyInto(out)
-	return out
-}

api/apps/v1alpha1/vminstance/types.go

@@ -1,100 +0,0 @@
-// Code generated by values-gen. DO NOT EDIT.
-// +kubebuilder:object:generate=true
-// +groupName=apps.cozystack.io
-// +versionName=v1alpha1
-package vminstance
-
-import (
-	resource "k8s.io/apimachinery/pkg/api/resource"
-	"k8s.io/apimachinery/pkg/apis/meta/v1"
-)
-
-// +kubebuilder:object:root=true
-type Config struct {
-	v1.TypeMeta   `json:",inline"`
-	v1.ObjectMeta `json:"metadata,omitempty"`
-	Spec          ConfigSpec `json:"spec,omitempty"`
-}
-
-type ConfigSpec struct {
-	// Enable external access from outside the cluster.
-	// +kubebuilder:default:=false
-	External bool `json:"external"`
-	// Method to pass through traffic to the VM.
-	// +kubebuilder:default:="PortList"
-	ExternalMethod ExternalMethod `json:"externalMethod"`
-	// Ports to forward from outside the cluster.
-	// +kubebuilder:default:={22}
-	ExternalPorts []int `json:"externalPorts,omitempty"`
-	// Whether to accept ICMP traffic to the VM in PortList mode (preserves ping and PMTU discovery). No effect in WholeIP mode. Default true so ping behaves as users expect even when port filtering is in effect.
-	// +kubebuilder:default:=true
-	ExternalAllowICMP bool `json:"externalAllowICMP"`
-	// Requested running state of the VirtualMachineInstance
-	// +kubebuilder:default:="Always"
-	RunStrategy RunStrategy `json:"runStrategy"`
-	// Virtual Machine instance type.
-	// +kubebuilder:default:="u1.medium"
-	InstanceType string `json:"instanceType"`
-	// Virtual Machine preferences profile.
-	// +kubebuilder:default:="ubuntu"
-	InstanceProfile string `json:"instanceProfile"`
-	// List of disks to attach.
-	// +kubebuilder:default:={}
-	Disks []Disk `json:"disks,omitempty"`
-	// Networks to attach the VM to.
-	// +kubebuilder:default:={}
-	Networks []Network `json:"networks,omitempty"`
-	// Deprecated: use networks instead.
-	// +kubebuilder:default:={}
-	Subnets []Network `json:"subnets,omitempty"`
-	// List of GPUs to attach (NVIDIA driver requires at least 4 GiB RAM).
-	// +kubebuilder:default:={}
-	Gpus []GPU `json:"gpus,omitempty"`
-	// Model specifies the CPU model inside the VMI. List of available models https://github.com/libvirt/libvirt/tree/master/src/cpu_map
-	// +kubebuilder:default:=""
-	CpuModel string `json:"cpuModel"`
-	// Resource configuration for the virtual machine.
-	// +kubebuilder:default:={}
-	Resources Resources `json:"resources,omitempty"`
-	// List of SSH public keys for authentication.
-	// +kubebuilder:default:={}
-	SshKeys []string `json:"sshKeys,omitempty"`
-	// Cloud-init user data.
-	// +kubebuilder:default:=""
-	CloudInit string `json:"cloudInit"`
-	// Seed string to generate SMBIOS UUID for the VM.
-	// +kubebuilder:default:=""
-	CloudInitSeed string `json:"cloudInitSeed"`
-}
-
-type Disk struct {
-	// Disk bus type (e.g. "sata").
-	Bus string `json:"bus,omitempty"`
-	// Disk name.
-	Name string `json:"name"`
-}
-
-type GPU struct {
-	// The name of the GPU resource to attach.
-	Name string `json:"name"`
-}
-
-type Network struct {
-	// Network attachment name.
-	Name string `json:"name,omitempty"`
-}
-
-type Resources struct {
-	// Number of CPU cores allocated.
-	Cpu resource.Quantity `json:"cpu,omitempty"`
-	// Amount of memory allocated.
-	Memory resource.Quantity `json:"memory,omitempty"`
-	// Number of CPU sockets (vCPU topology).
-	Sockets resource.Quantity `json:"sockets,omitempty"`
-}
-
-// +kubebuilder:validation:Enum="PortList";"WholeIP"
-type ExternalMethod string
-
-// +kubebuilder:validation:Enum="Always";"Halted";"Manual";"RerunOnFailure";"Once"
-type RunStrategy string

api/apps/v1alpha1/vminstance/zz_generated.deepcopy.go

@@ -1,160 +0,0 @@
-//go:build !ignore_autogenerated
-
-/*
-Copyright 2025 The Cozystack Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-// Code generated by controller-gen. DO NOT EDIT.
-
-package vminstance
-
-import (
-	runtime "k8s.io/apimachinery/pkg/runtime"
-)
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *Config) DeepCopyInto(out *Config) {
-	*out = *in
-	out.TypeMeta = in.TypeMeta
-	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
-	in.Spec.DeepCopyInto(&out.Spec)
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Config.
-func (in *Config) DeepCopy() *Config {
-	if in == nil {
-		return nil
-	}
-	out := new(Config)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
-func (in *Config) DeepCopyObject() runtime.Object {
-	if c := in.DeepCopy(); c != nil {
-		return c
-	}
-	return nil
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *ConfigSpec) DeepCopyInto(out *ConfigSpec) {
-	*out = *in
-	if in.ExternalPorts != nil {
-		in, out := &in.ExternalPorts, &out.ExternalPorts
-		*out = make([]int, len(*in))
-		copy(*out, *in)
-	}
-	if in.Disks != nil {
-		in, out := &in.Disks, &out.Disks
-		*out = make([]Disk, len(*in))
-		copy(*out, *in)
-	}
-	if in.Networks != nil {
-		in, out := &in.Networks, &out.Networks
-		*out = make([]Network, len(*in))
-		copy(*out, *in)
-	}
-	if in.Subnets != nil {
-		in, out := &in.Subnets, &out.Subnets
-		*out = make([]Network, len(*in))
-		copy(*out, *in)
-	}
-	if in.Gpus != nil {
-		in, out := &in.Gpus, &out.Gpus
-		*out = make([]GPU, len(*in))
-		copy(*out, *in)
-	}
-	in.Resources.DeepCopyInto(&out.Resources)
-	if in.SshKeys != nil {
-		in, out := &in.SshKeys, &out.SshKeys
-		*out = make([]string, len(*in))
-		copy(*out, *in)
-	}
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ConfigSpec.
-func (in *ConfigSpec) DeepCopy() *ConfigSpec {
-	if in == nil {
-		return nil
-	}
-	out := new(ConfigSpec)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *Disk) DeepCopyInto(out *Disk) {
-	*out = *in
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Disk.
-func (in *Disk) DeepCopy() *Disk {
-	if in == nil {
-		return nil
-	}
-	out := new(Disk)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *GPU) DeepCopyInto(out *GPU) {
-	*out = *in
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GPU.
-func (in *GPU) DeepCopy() *GPU {
-	if in == nil {
-		return nil
-	}
-	out := new(GPU)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *Network) DeepCopyInto(out *Network) {
-	*out = *in
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Network.
-func (in *Network) DeepCopy() *Network {
-	if in == nil {
-		return nil
-	}
-	out := new(Network)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *Resources) DeepCopyInto(out *Resources) {
-	*out = *in
-	out.Cpu = in.Cpu.DeepCopy()
-	out.Memory = in.Memory.DeepCopy()
-	out.Sockets = in.Sockets.DeepCopy()
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Resources.
-func (in *Resources) DeepCopy() *Resources {
-	if in == nil {
-		return nil
-	}
-	out := new(Resources)
-	in.DeepCopyInto(out)
-	return out
-}

api/apps/v1alpha1/vpc/types.go

@@ -1,49 +0,0 @@
-// Code generated by values-gen. DO NOT EDIT.
-// +kubebuilder:object:generate=true
-// +groupName=apps.cozystack.io
-// +versionName=v1alpha1
-package vpc
-
-import (
-	"k8s.io/apimachinery/pkg/apis/meta/v1"
-)
-
-// +kubebuilder:object:root=true
-type Config struct {
-	v1.TypeMeta   `json:",inline"`
-	v1.ObjectMeta `json:"metadata,omitempty"`
-	Spec          ConfigSpec `json:"spec,omitempty"`
-}
-
-type ConfigSpec struct {
-	// Subnets of a VPC
-	// +kubebuilder:default:={}
-	Subnets []Subnet `json:"subnets,omitempty"`
-	// VPC peering connections (bidirectional declaration required)
-	// +kubebuilder:default:={}
-	Peers []Peer `json:"peers,omitempty"`
-	// Static routes for the VPC
-	// +kubebuilder:default:={}
-	Routes []Route `json:"routes,omitempty"`
-}
-
-type Peer struct {
-	// Namespace of the remote tenant
-	TenantNamespace string `json:"tenantNamespace"`
-	// Logical name of the remote VPC (without "virtualprivatecloud-" prefix)
-	VpcName string `json:"vpcName"`
-}
-
-type Route struct {
-	// Destination CIDR
-	Cidr string `json:"cidr"`
-	// Next hop IP address
-	NextHopIP string `json:"nextHopIP"`
-}
-
-type Subnet struct {
-	// IP address range
-	Cidr string `json:"cidr,omitempty"`
-	// Subnet name
-	Name string `json:"name"`
-}

api/apps/v1alpha1/vpc/zz_generated.deepcopy.go

@@ -1,126 +0,0 @@
-//go:build !ignore_autogenerated
-
-/*
-Copyright 2025 The Cozystack Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-// Code generated by controller-gen. DO NOT EDIT.
-
-package vpc
-
-import (
-	runtime "k8s.io/apimachinery/pkg/runtime"
-)
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *Config) DeepCopyInto(out *Config) {
-	*out = *in
-	out.TypeMeta = in.TypeMeta
-	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
-	in.Spec.DeepCopyInto(&out.Spec)
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Config.
-func (in *Config) DeepCopy() *Config {
-	if in == nil {
-		return nil
-	}
-	out := new(Config)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
-func (in *Config) DeepCopyObject() runtime.Object {
-	if c := in.DeepCopy(); c != nil {
-		return c
-	}
-	return nil
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *ConfigSpec) DeepCopyInto(out *ConfigSpec) {
-	*out = *in
-	if in.Subnets != nil {
-		in, out := &in.Subnets, &out.Subnets
-		*out = make([]Subnet, len(*in))
-		copy(*out, *in)
-	}
-	if in.Peers != nil {
-		in, out := &in.Peers, &out.Peers
-		*out = make([]Peer, len(*in))
-		copy(*out, *in)
-	}
-	if in.Routes != nil {
-		in, out := &in.Routes, &out.Routes
-		*out = make([]Route, len(*in))
-		copy(*out, *in)
-	}
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ConfigSpec.
-func (in *ConfigSpec) DeepCopy() *ConfigSpec {
-	if in == nil {
-		return nil
-	}
-	out := new(ConfigSpec)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *Peer) DeepCopyInto(out *Peer) {
-	*out = *in
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Peer.
-func (in *Peer) DeepCopy() *Peer {
-	if in == nil {
-		return nil
-	}
-	out := new(Peer)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *Route) DeepCopyInto(out *Route) {
-	*out = *in
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Route.
-func (in *Route) DeepCopy() *Route {
-	if in == nil {
-		return nil
-	}
-	out := new(Route)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *Subnet) DeepCopyInto(out *Subnet) {
-	*out = *in
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Subnet.
-func (in *Subnet) DeepCopy() *Subnet {
-	if in == nil {
-		return nil
-	}
-	out := new(Subnet)
-	in.DeepCopyInto(out)
-	return out
-}

api/apps/v1alpha1/vpn/types.go

@@ -1,56 +0,0 @@
-// Code generated by values-gen. DO NOT EDIT.
-// +kubebuilder:object:generate=true
-// +groupName=apps.cozystack.io
-// +versionName=v1alpha1
-package vpn
-
-import (
-	resource "k8s.io/apimachinery/pkg/api/resource"
-	"k8s.io/apimachinery/pkg/apis/meta/v1"
-)
-
-// +kubebuilder:object:root=true
-type Config struct {
-	v1.TypeMeta   `json:",inline"`
-	v1.ObjectMeta `json:"metadata,omitempty"`
-	Spec          ConfigSpec `json:"spec,omitempty"`
-}
-
-type ConfigSpec struct {
-	// Number of VPN server replicas.
-	// +kubebuilder:default:=2
-	Replicas int `json:"replicas"`
-	// Explicit CPU and memory configuration for each VPN server replica. When omitted, the preset defined in `resourcesPreset` is applied.
-	// +kubebuilder:default:={}
-	Resources Resources `json:"resources,omitempty"`
-	// Default sizing preset used when `resources` is omitted.
-	// +kubebuilder:default:="nano"
-	ResourcesPreset ResourcesPreset `json:"resourcesPreset"`
-	// Enable external access from outside the cluster.
-	// +kubebuilder:default:=false
-	External bool `json:"external"`
-	// Host used to substitute into generated URLs.
-	// +kubebuilder:default:=""
-	Host string `json:"host"`
-	// Users configuration map.
-	// +kubebuilder:default:={}
-	Users map[string]User `json:"users,omitempty"`
-	// List of externalIPs for service. Optional. If not specified, will use LoadBalancer service by default.
-	// +kubebuilder:default:={}
-	ExternalIPs []string `json:"externalIPs,omitempty"`
-}
-
-type Resources struct {
-	// CPU available to each replica.
-	Cpu resource.Quantity `json:"cpu,omitempty"`
-	// Memory (RAM) available to each replica.
-	Memory resource.Quantity `json:"memory,omitempty"`
-}
-
-type User struct {
-	// Password for the user (autogenerated if not provided).
-	Password string `json:"password,omitempty"`
-}
-
-// +kubebuilder:validation:Enum="nano";"micro";"small";"medium";"large";"xlarge";"2xlarge"
-type ResourcesPreset string

api/apps/v1alpha1/vpn/zz_generated.deepcopy.go

@@ -1,111 +0,0 @@
-//go:build !ignore_autogenerated
-
-/*
-Copyright 2025 The Cozystack Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-// Code generated by controller-gen. DO NOT EDIT.
-
-package vpn
-
-import (
-	runtime "k8s.io/apimachinery/pkg/runtime"
-)
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *Config) DeepCopyInto(out *Config) {
-	*out = *in
-	out.TypeMeta = in.TypeMeta
-	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
-	in.Spec.DeepCopyInto(&out.Spec)
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Config.
-func (in *Config) DeepCopy() *Config {
-	if in == nil {
-		return nil
-	}
-	out := new(Config)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
-func (in *Config) DeepCopyObject() runtime.Object {
-	if c := in.DeepCopy(); c != nil {
-		return c
-	}
-	return nil
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *ConfigSpec) DeepCopyInto(out *ConfigSpec) {
-	*out = *in
-	in.Resources.DeepCopyInto(&out.Resources)
-	if in.Users != nil {
-		in, out := &in.Users, &out.Users
-		*out = make(map[string]User, len(*in))
-		for key, val := range *in {
-			(*out)[key] = val
-		}
-	}
-	if in.ExternalIPs != nil {
-		in, out := &in.ExternalIPs, &out.ExternalIPs
-		*out = make([]string, len(*in))
-		copy(*out, *in)
-	}
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ConfigSpec.
-func (in *ConfigSpec) DeepCopy() *ConfigSpec {
-	if in == nil {
-		return nil
-	}
-	out := new(ConfigSpec)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *Resources) DeepCopyInto(out *Resources) {
-	*out = *in
-	out.Cpu = in.Cpu.DeepCopy()
-	out.Memory = in.Memory.DeepCopy()
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Resources.
-func (in *Resources) DeepCopy() *Resources {
-	if in == nil {
-		return nil
-	}
-	out := new(Resources)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *User) DeepCopyInto(out *User) {
-	*out = *in
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new User.
-func (in *User) DeepCopy() *User {
-	if in == nil {
-		return nil
-	}
-	out := new(User)
-	in.DeepCopyInto(out)
-	return out
-}

api/backups/v1alpha1/backup_types.go

@@ -72,15 +72,6 @@ type BackupSpec struct {
 	DriverMetadata map[string]string `json:"driverMetadata,omitempty"`
 }
 
-// DataVolumeResource describes a dataVolume associated with the backed-up application.
-type DataVolumeResource struct {
-	// DataVolumeName is the name of the dataVolume/PVC (e.g., "vm-disk-ubuntu-source").
-	DataVolumeName string `json:"dataVolumeName"`
-
-	// ApplicationName is the cozystack application name for this disk (e.g., "ubuntu-source").
-	ApplicationName string `json:"applicationName"`
-}
-
 // BackupStatus represents the observed state of a Backup.
 type BackupStatus struct {
 	// Phase is a simple, high-level summary of the backup's state.
@@ -92,15 +83,6 @@ type BackupStatus struct {
 	// +optional
 	Artifact *BackupArtifact `json:"artifact,omitempty"`
 
-	// UnderlyingResources holds application-specific resource metadata discovered
-	// during backup (e.g., VM disks, network configuration). The payload is a
-	// self-typed JSON object carrying an inlined TypeMeta (kind/apiVersion) so
-	// the consuming controller can dispatch on the application kind.
-	// +optional
-	// +kubebuilder:pruning:PreserveUnknownFields
-	// +kubebuilder:validation:Type=object
-	UnderlyingResources *runtime.RawExtension `json:"underlyingResources,omitempty"`
-
 	// Conditions represents the latest available observations of a Backup's state.
 	// +optional
 	Conditions []metav1.Condition `json:"conditions,omitempty"`

api/backups/v1alpha1/restorejob_types.go

@@ -42,12 +42,6 @@ type RestoreJobSpec struct {
 	// application as referenced by backup.spec.applicationRef.
 	// +optional
 	TargetApplicationRef *corev1.TypedLocalObjectReference `json:"targetApplicationRef,omitempty"`
-
-	// Options is a driver-specific blob of restore options, typed based on
-	// targetApplicationRef and the current controller implementation.
-	// +optional
-	// +kubebuilder:pruning:PreserveUnknownFields
-	Options *runtime.RawExtension `json:"options,omitempty"`
 }
 
 // RestoreJobStatus represents the observed state of a RestoreJob.

api/backups/v1alpha1/zz_generated.deepcopy.go

@@ -400,11 +400,6 @@ func (in *BackupStatus) DeepCopyInto(out *BackupStatus) {
 		*out = new(BackupArtifact)
 		**out = **in
 	}
-	if in.UnderlyingResources != nil {
-		in, out := &in.UnderlyingResources, &out.UnderlyingResources
-		*out = new(runtime.RawExtension)
-		(*in).DeepCopyInto(*out)
-	}
 	if in.Conditions != nil {
 		in, out := &in.Conditions, &out.Conditions
 		*out = make([]metav1.Condition, len(*in))
@@ -424,21 +419,6 @@ func (in *BackupStatus) DeepCopy() *BackupStatus {
 	return out
 }
 
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *DataVolumeResource) DeepCopyInto(out *DataVolumeResource) {
-	*out = *in
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new DataVolumeResource.
-func (in *DataVolumeResource) DeepCopy() *DataVolumeResource {
-	if in == nil {
-		return nil
-	}
-	out := new(DataVolumeResource)
-	in.DeepCopyInto(out)
-	return out
-}
-
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *Plan) DeepCopyInto(out *Plan) {
 	*out = *in
@@ -620,11 +600,6 @@ func (in *RestoreJobSpec) DeepCopyInto(out *RestoreJobSpec) {
 		*out = new(v1.TypedLocalObjectReference)
 		(*in).DeepCopyInto(*out)
 	}
-	if in.Options != nil {
-		in, out := &in.Options, &out.Options
-		*out = new(runtime.RawExtension)
-		(*in).DeepCopyInto(*out)
-	}
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RestoreJobSpec.

api/v1alpha1/packagesource_types.go

@@ -132,16 +132,6 @@ type ComponentInstall struct {
 	// DependsOn is a list of component names that must be installed before this component
 	// +optional
 	DependsOn []string `json:"dependsOn,omitempty"`
-
-	// UpgradeCRDs controls how CRDs from the chart's crds/ directory are
-	// handled on HelmRelease upgrades. Maps to HelmRelease.Spec.Upgrade.CRDs.
-	// Empty string (default) preserves the helm-controller default (Skip).
-	// Use "CreateReplace" for operators that evolve their CRD set between
-	// versions. Warning: CreateReplace overwrites CRDs and may cause data
-	// loss if upstream drops fields from a CRD with live objects.
-	// +optional
-	// +kubebuilder:validation:Enum=Skip;Create;CreateReplace
-	UpgradeCRDs string `json:"upgradeCRDs,omitempty"`
 }
 
 // Component defines a single Helm release component within a package source

cmd/backupstrategy-controller/main.go

@@ -176,15 +176,6 @@ func main() {
 		os.Exit(1)
 	}
 
-	if err = (&backupcontroller.BackupReconciler{
-		Client:   mgr.GetClient(),
-		Scheme:   mgr.GetScheme(),
-		Recorder: mgr.GetEventRecorderFor("backup-controller"),
-	}).SetupWithManager(mgr); err != nil {
-		setupLog.Error(err, "unable to create controller", "controller", "Backup")
-		os.Exit(1)
-	}
-
 	// +kubebuilder:scaffold:builder
 
 	if err := mgr.AddHealthzCheck("healthz", healthz.Ping); err != nil {

cmd/cozystack-controller/main.go

@@ -42,7 +42,6 @@ import (
 	"github.com/cozystack/cozystack/internal/telemetry"
 
 	helmv2 "github.com/fluxcd/helm-controller/api/v2"
-	cosiv1alpha1 "sigs.k8s.io/container-object-storage-interface-api/apis/objectstorage/v1alpha1"
 	// +kubebuilder:scaffold:imports
 )
 
@@ -57,7 +56,6 @@ func init() {
 	utilruntime.Must(cozystackiov1alpha1.AddToScheme(scheme))
 	utilruntime.Must(dashboard.AddToScheme(scheme))
 	utilruntime.Must(helmv2.AddToScheme(scheme))
-	utilruntime.Must(cosiv1alpha1.AddToScheme(scheme))
 	// +kubebuilder:scaffold:scheme
 }
 

cmd/cozystack-operator/main.go

@@ -108,7 +108,7 @@ func main() {
 	flag.StringVar(&telemetryInterval, "telemetry-interval", "15m",
 		"Interval between telemetry data collection (e.g. 15m, 1h)")
 	flag.StringVar(&platformSourceURL, "platform-source-url", "", "Platform source URL (oci:// or https://). If specified, generates OCIRepository or GitRepository resource.")
-	flag.StringVar(&platformSourceName, "platform-source-name", "cozystack-platform", "Name for the generated platform source resource and PackageSource")
+	flag.StringVar(&platformSourceName, "platform-source-name", "cozystack-packages", "Name for the generated platform source resource (default: cozystack-packages)")
 	flag.StringVar(&platformSourceRef, "platform-source-ref", "", "Reference specification as key=value pairs (e.g., 'branch=main' or 'digest=sha256:...,tag=v1.0'). For OCI: digest, semver, semverFilter, tag. For Git: branch, tag, semver, name, commit.")
 	flag.StringVar(&cozyValuesSecretName, "cozy-values-secret-name", "cozystack-values", "The name of the secret containing cluster-wide configuration values.")
 	flag.StringVar(&cozyValuesSecretNamespace, "cozy-values-secret-namespace", "cozy-system", "The namespace of the secret containing cluster-wide configuration values.")
@@ -224,29 +224,6 @@ func main() {
 		}
 	}
 
-	// Create platform PackageSource when CRDs are managed by the operator and
-	// a platform source URL is configured. Without a URL there is no Flux source
-	// resource to reference, so creating a PackageSource would leave a dangling SourceRef.
-	if installCRDs && platformSourceURL != "" {
-		sourceRefKind := "OCIRepository"
-		sourceType, _, err := parsePlatformSourceURL(platformSourceURL)
-		if err != nil {
-			setupLog.Error(err, "failed to parse platform source URL for PackageSource")
-			os.Exit(1)
-		}
-		if sourceType == "git" {
-			sourceRefKind = "GitRepository"
-		}
-		setupLog.Info("Creating platform PackageSource", "platformSourceName", platformSourceName)
-		psCtx, psCancel := context.WithTimeout(mgrCtx, 2*time.Minute)
-		defer psCancel()
-		if err := installPlatformPackageSource(psCtx, directClient, platformSourceName, sourceRefKind); err != nil {
-			setupLog.Error(err, "failed to create platform PackageSource")
-			os.Exit(1)
-		}
-		setupLog.Info("Platform PackageSource creation completed successfully")
-	}
-
 	// Setup PackageSource reconciler
 	if err := (&operator.PackageSourceReconciler{
 		Client: mgr.GetClient(),
@@ -575,79 +552,3 @@ func generateGitRepository(name, repoURL string, refMap map[string]string) (*sou
 
 	return obj, nil
 }
-
-// installPlatformPackageSource creates the platform PackageSource resource
-// that references the Flux source resource (OCIRepository or GitRepository).
-//
-// The variant list is intentionally hardcoded here. These are platform-defined
-// deployment profiles (not user-extensible), matching what was previously in
-// the Helm template. Changes require a new operator build and release.
-func installPlatformPackageSource(ctx context.Context, k8sClient client.Client, platformSourceName, sourceRefKind string) error {
-	logger := log.FromContext(ctx)
-
-	packageSourceName := "cozystack." + platformSourceName
-
-	ps := &cozyv1alpha1.PackageSource{
-		TypeMeta: metav1.TypeMeta{
-			APIVersion: cozyv1alpha1.GroupVersion.String(),
-			Kind:       "PackageSource",
-		},
-		ObjectMeta: metav1.ObjectMeta{
-			Name: packageSourceName,
-			Annotations: map[string]string{
-				"operator.cozystack.io/skip-cozystack-values": "true",
-			},
-		},
-		Spec: cozyv1alpha1.PackageSourceSpec{
-			SourceRef: &cozyv1alpha1.PackageSourceRef{
-				Kind:      sourceRefKind,
-				Name:      platformSourceName,
-				Namespace: "cozy-system",
-				Path:      "/",
-			},
-		},
-	}
-
-	variantData := []struct {
-		name        string
-		valuesFiles []string
-	}{
-		{"default", []string{"values.yaml"}},
-		{"isp-full", []string{"values.yaml", "values-isp-full.yaml"}},
-		{"isp-hosted", []string{"values.yaml", "values-isp-hosted.yaml"}},
-		{"isp-full-generic", []string{"values.yaml", "values-isp-full-generic.yaml"}},
-	}
-
-	variants := make([]cozyv1alpha1.Variant, len(variantData))
-	for i, v := range variantData {
-		variants[i] = cozyv1alpha1.Variant{
-			Name: v.name,
-			Components: []cozyv1alpha1.Component{
-				{
-					Name: "platform",
-					Path: "core/platform",
-					Install: &cozyv1alpha1.ComponentInstall{
-						Namespace:   "cozy-system",
-						ReleaseName: "cozystack-platform",
-					},
-					ValuesFiles: v.valuesFiles,
-				},
-			},
-		}
-	}
-	ps.Spec.Variants = variants
-
-	logger.Info("Applying platform PackageSource", "name", packageSourceName)
-
-	patchOptions := &client.PatchOptions{
-		FieldManager: "cozystack-operator",
-		Force:        func() *bool { b := true; return &b }(),
-	}
-
-	if err := k8sClient.Patch(ctx, ps, client.Apply, patchOptions); err != nil {
-		return fmt.Errorf("failed to apply PackageSource %s: %w", packageSourceName, err)
-	}
-
-	logger.Info("Applied platform PackageSource", "name", packageSourceName)
-	return nil
-}

cmd/cozystack-operator/main_test.go

@@ -1,574 +0,0 @@
-/*
-Copyright 2025 The Cozystack Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package main
-
-import (
-	"context"
-	"testing"
-
-	cozyv1alpha1 "github.com/cozystack/cozystack/api/v1alpha1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"sigs.k8s.io/controller-runtime/pkg/client"
-	"sigs.k8s.io/controller-runtime/pkg/client/fake"
-)
-
-func newTestScheme() *runtime.Scheme {
-	s := runtime.NewScheme()
-	_ = cozyv1alpha1.AddToScheme(s)
-	return s
-}
-
-func TestInstallPlatformPackageSource_Creates(t *testing.T) {
-	s := newTestScheme()
-	k8sClient := fake.NewClientBuilder().WithScheme(s).Build()
-
-	err := installPlatformPackageSource(context.Background(), k8sClient, "cozystack-platform", "OCIRepository")
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-
-	ps := &cozyv1alpha1.PackageSource{}
-	if err := k8sClient.Get(context.Background(), client.ObjectKey{Name: "cozystack.cozystack-platform"}, ps); err != nil {
-		t.Fatalf("PackageSource not found: %v", err)
-	}
-
-	// Verify name
-	if ps.Name != "cozystack.cozystack-platform" {
-		t.Errorf("expected name %q, got %q", "cozystack.cozystack-platform", ps.Name)
-	}
-
-	// Verify annotation
-	if ps.Annotations["operator.cozystack.io/skip-cozystack-values"] != "true" {
-		t.Errorf("expected skip-cozystack-values annotation to be 'true', got %q", ps.Annotations["operator.cozystack.io/skip-cozystack-values"])
-	}
-
-	// Verify sourceRef
-	if ps.Spec.SourceRef == nil {
-		t.Fatal("expected SourceRef to be set")
-	}
-	if ps.Spec.SourceRef.Kind != "OCIRepository" {
-		t.Errorf("expected sourceRef.kind %q, got %q", "OCIRepository", ps.Spec.SourceRef.Kind)
-	}
-	if ps.Spec.SourceRef.Name != "cozystack-platform" {
-		t.Errorf("expected sourceRef.name %q, got %q", "cozystack-platform", ps.Spec.SourceRef.Name)
-	}
-	if ps.Spec.SourceRef.Namespace != "cozy-system" {
-		t.Errorf("expected sourceRef.namespace %q, got %q", "cozy-system", ps.Spec.SourceRef.Namespace)
-	}
-	if ps.Spec.SourceRef.Path != "/" {
-		t.Errorf("expected sourceRef.path %q, got %q", "/", ps.Spec.SourceRef.Path)
-	}
-
-	// Verify variants
-	expectedVariants := []string{"default", "isp-full", "isp-hosted", "isp-full-generic"}
-	if len(ps.Spec.Variants) != len(expectedVariants) {
-		t.Fatalf("expected %d variants, got %d", len(expectedVariants), len(ps.Spec.Variants))
-	}
-	for i, name := range expectedVariants {
-		if ps.Spec.Variants[i].Name != name {
-			t.Errorf("expected variant[%d].name %q, got %q", i, name, ps.Spec.Variants[i].Name)
-		}
-		if len(ps.Spec.Variants[i].Components) != 1 {
-			t.Errorf("expected variant[%d] to have 1 component, got %d", i, len(ps.Spec.Variants[i].Components))
-		}
-	}
-}
-
-func TestInstallPlatformPackageSource_Updates(t *testing.T) {
-	s := newTestScheme()
-
-	existing := &cozyv1alpha1.PackageSource{
-		ObjectMeta: metav1.ObjectMeta{
-			Name:            "cozystack.cozystack-platform",
-			ResourceVersion: "1",
-			Labels: map[string]string{
-				"custom-label": "should-be-preserved",
-			},
-		},
-		Spec: cozyv1alpha1.PackageSourceSpec{
-			SourceRef: &cozyv1alpha1.PackageSourceRef{
-				Kind:      "OCIRepository",
-				Name:      "old-name",
-				Namespace: "cozy-system",
-			},
-		},
-	}
-
-	k8sClient := fake.NewClientBuilder().WithScheme(s).WithObjects(existing).Build()
-
-	err := installPlatformPackageSource(context.Background(), k8sClient, "cozystack-platform", "OCIRepository")
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-
-	ps := &cozyv1alpha1.PackageSource{}
-	if err := k8sClient.Get(context.Background(), client.ObjectKey{Name: "cozystack.cozystack-platform"}, ps); err != nil {
-		t.Fatalf("PackageSource not found: %v", err)
-	}
-
-	// Verify sourceRef was updated
-	if ps.Spec.SourceRef.Name != "cozystack-platform" {
-		t.Errorf("expected updated sourceRef.name %q, got %q", "cozystack-platform", ps.Spec.SourceRef.Name)
-	}
-
-	// Verify all 4 variants are present after update
-	if len(ps.Spec.Variants) != 4 {
-		t.Errorf("expected 4 variants after update, got %d", len(ps.Spec.Variants))
-	}
-
-	// Verify that labels set by other controllers are preserved (SSA does not overwrite unmanaged fields)
-	if ps.Labels["custom-label"] != "should-be-preserved" {
-		t.Errorf("expected custom-label to be preserved, got %q", ps.Labels["custom-label"])
-	}
-}
-
-func TestParsePlatformSourceURL(t *testing.T) {
-	tests := []struct {
-		name       string
-		url        string
-		wantType   string
-		wantURL    string
-		wantErr    bool
-	}{
-		{
-			name:     "OCI URL",
-			url:      "oci://ghcr.io/cozystack/cozystack/cozystack-packages",
-			wantType: "oci",
-			wantURL:  "oci://ghcr.io/cozystack/cozystack/cozystack-packages",
-		},
-		{
-			name:     "HTTPS URL",
-			url:      "https://github.com/cozystack/cozystack",
-			wantType: "git",
-			wantURL:  "https://github.com/cozystack/cozystack",
-		},
-		{
-			name:     "SSH URL",
-			url:      "ssh://git@github.com/cozystack/cozystack",
-			wantType: "git",
-			wantURL:  "ssh://git@github.com/cozystack/cozystack",
-		},
-		{
-			name:    "empty URL",
-			url:     "",
-			wantErr: true,
-		},
-		{
-			name:    "unsupported scheme",
-			url:     "ftp://example.com/repo",
-			wantErr: true,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			sourceType, repoURL, err := parsePlatformSourceURL(tt.url)
-			if tt.wantErr {
-				if err == nil {
-					t.Fatalf("expected error for URL %q, got nil", tt.url)
-				}
-				return
-			}
-			if err != nil {
-				t.Fatalf("unexpected error: %v", err)
-			}
-			if sourceType != tt.wantType {
-				t.Errorf("expected type %q, got %q", tt.wantType, sourceType)
-			}
-			if repoURL != tt.wantURL {
-				t.Errorf("expected URL %q, got %q", tt.wantURL, repoURL)
-			}
-		})
-	}
-}
-
-func TestInstallPlatformPackageSource_VariantValuesFiles(t *testing.T) {
-	s := newTestScheme()
-	k8sClient := fake.NewClientBuilder().WithScheme(s).Build()
-
-	err := installPlatformPackageSource(context.Background(), k8sClient, "cozystack-platform", "OCIRepository")
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-
-	ps := &cozyv1alpha1.PackageSource{}
-	if err := k8sClient.Get(context.Background(), client.ObjectKey{Name: "cozystack.cozystack-platform"}, ps); err != nil {
-		t.Fatalf("PackageSource not found: %v", err)
-	}
-
-	expectedValuesFiles := map[string][]string{
-		"default":          {"values.yaml"},
-		"isp-full":         {"values.yaml", "values-isp-full.yaml"},
-		"isp-hosted":       {"values.yaml", "values-isp-hosted.yaml"},
-		"isp-full-generic": {"values.yaml", "values-isp-full-generic.yaml"},
-	}
-
-	for _, v := range ps.Spec.Variants {
-		expected, ok := expectedValuesFiles[v.Name]
-		if !ok {
-			t.Errorf("unexpected variant %q", v.Name)
-			continue
-		}
-
-		if len(v.Components) != 1 {
-			t.Errorf("variant %q: expected 1 component, got %d", v.Name, len(v.Components))
-			continue
-		}
-
-		comp := v.Components[0]
-		if comp.Name != "platform" {
-			t.Errorf("variant %q: expected component name %q, got %q", v.Name, "platform", comp.Name)
-		}
-		if comp.Path != "core/platform" {
-			t.Errorf("variant %q: expected component path %q, got %q", v.Name, "core/platform", comp.Path)
-		}
-		if comp.Install == nil {
-			t.Errorf("variant %q: expected Install to be set", v.Name)
-		} else {
-			if comp.Install.Namespace != "cozy-system" {
-				t.Errorf("variant %q: expected install namespace %q, got %q", v.Name, "cozy-system", comp.Install.Namespace)
-			}
-			if comp.Install.ReleaseName != "cozystack-platform" {
-				t.Errorf("variant %q: expected install releaseName %q, got %q", v.Name, "cozystack-platform", comp.Install.ReleaseName)
-			}
-		}
-
-		if len(comp.ValuesFiles) != len(expected) {
-			t.Errorf("variant %q: expected %d valuesFiles, got %d", v.Name, len(expected), len(comp.ValuesFiles))
-			continue
-		}
-		for i, f := range expected {
-			if comp.ValuesFiles[i] != f {
-				t.Errorf("variant %q: expected valuesFiles[%d] %q, got %q", v.Name, i, f, comp.ValuesFiles[i])
-			}
-		}
-	}
-}
-
-func TestInstallPlatformPackageSource_CustomName(t *testing.T) {
-	s := newTestScheme()
-	k8sClient := fake.NewClientBuilder().WithScheme(s).Build()
-
-	err := installPlatformPackageSource(context.Background(), k8sClient, "custom-source", "OCIRepository")
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-
-	ps := &cozyv1alpha1.PackageSource{}
-	if err := k8sClient.Get(context.Background(), client.ObjectKey{Name: "cozystack.custom-source"}, ps); err != nil {
-		t.Fatalf("PackageSource not found: %v", err)
-	}
-
-	if ps.Name != "cozystack.custom-source" {
-		t.Errorf("expected name %q, got %q", "cozystack.custom-source", ps.Name)
-	}
-	if ps.Spec.SourceRef.Name != "custom-source" {
-		t.Errorf("expected sourceRef.name %q, got %q", "custom-source", ps.Spec.SourceRef.Name)
-	}
-}
-
-func TestInstallPlatformPackageSource_GitRepository(t *testing.T) {
-	s := newTestScheme()
-	k8sClient := fake.NewClientBuilder().WithScheme(s).Build()
-
-	err := installPlatformPackageSource(context.Background(), k8sClient, "my-source", "GitRepository")
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-
-	ps := &cozyv1alpha1.PackageSource{}
-	if err := k8sClient.Get(context.Background(), client.ObjectKey{Name: "cozystack.my-source"}, ps); err != nil {
-		t.Fatalf("PackageSource not found: %v", err)
-	}
-
-	if ps.Spec.SourceRef.Kind != "GitRepository" {
-		t.Errorf("expected sourceRef.kind %q, got %q", "GitRepository", ps.Spec.SourceRef.Kind)
-	}
-	if ps.Spec.SourceRef.Name != "my-source" {
-		t.Errorf("expected sourceRef.name %q, got %q", "my-source", ps.Spec.SourceRef.Name)
-	}
-}
-
-func TestParseRefSpec(t *testing.T) {
-	tests := []struct {
-		name    string
-		input   string
-		want    map[string]string
-		wantErr bool
-	}{
-		{
-			name:  "empty string",
-			input: "",
-			want:  map[string]string{},
-		},
-		{
-			name:  "single key-value",
-			input: "tag=v1.0",
-			want:  map[string]string{"tag": "v1.0"},
-		},
-		{
-			name:  "multiple key-values",
-			input: "digest=sha256:abc123,tag=v1.0",
-			want:  map[string]string{"digest": "sha256:abc123", "tag": "v1.0"},
-		},
-		{
-			name:  "whitespace around pairs",
-			input: " tag=v1.0 , branch=main ",
-			want:  map[string]string{"tag": "v1.0", "branch": "main"},
-		},
-		{
-			name:  "equals sign in value",
-			input: "digest=sha256:abc=123",
-			want:  map[string]string{"digest": "sha256:abc=123"},
-		},
-		{
-			name:    "missing equals sign",
-			input:   "tag",
-			wantErr: true,
-		},
-		{
-			name:    "empty key",
-			input:   "=value",
-			wantErr: true,
-		},
-		{
-			name:    "empty value",
-			input:   "tag=",
-			wantErr: true,
-		},
-		{
-			name:  "trailing comma",
-			input: "tag=v1.0,",
-			want:  map[string]string{"tag": "v1.0"},
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			got, err := parseRefSpec(tt.input)
-			if tt.wantErr {
-				if err == nil {
-					t.Fatalf("expected error for input %q, got nil", tt.input)
-				}
-				return
-			}
-			if err != nil {
-				t.Fatalf("unexpected error: %v", err)
-			}
-			if len(got) != len(tt.want) {
-				t.Fatalf("expected %d entries, got %d: %v", len(tt.want), len(got), got)
-			}
-			for k, v := range tt.want {
-				if got[k] != v {
-					t.Errorf("expected %q=%q, got %q=%q", k, v, k, got[k])
-				}
-			}
-		})
-	}
-}
-
-func TestValidateOCIRef(t *testing.T) {
-	tests := []struct {
-		name    string
-		refMap  map[string]string
-		wantErr bool
-	}{
-		{
-			name:   "valid tag",
-			refMap: map[string]string{"tag": "v1.0"},
-		},
-		{
-			name:   "valid digest",
-			refMap: map[string]string{"digest": "sha256:abc123def456"},
-		},
-		{
-			name:   "valid semver",
-			refMap: map[string]string{"semver": ">=1.0.0"},
-		},
-		{
-			name:   "multiple valid keys",
-			refMap: map[string]string{"tag": "v1.0", "digest": "sha256:abc"},
-		},
-		{
-			name:   "empty map",
-			refMap: map[string]string{},
-		},
-		{
-			name:    "invalid key",
-			refMap:  map[string]string{"branch": "main"},
-			wantErr: true,
-		},
-		{
-			name:    "invalid digest format",
-			refMap:  map[string]string{"digest": "md5:abc"},
-			wantErr: true,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			err := validateOCIRef(tt.refMap)
-			if tt.wantErr && err == nil {
-				t.Fatal("expected error, got nil")
-			}
-			if !tt.wantErr && err != nil {
-				t.Fatalf("unexpected error: %v", err)
-			}
-		})
-	}
-}
-
-func TestValidateGitRef(t *testing.T) {
-	tests := []struct {
-		name    string
-		refMap  map[string]string
-		wantErr bool
-	}{
-		{
-			name:   "valid branch",
-			refMap: map[string]string{"branch": "main"},
-		},
-		{
-			name:   "valid commit",
-			refMap: map[string]string{"commit": "abc1234"},
-		},
-		{
-			name:   "valid tag and branch",
-			refMap: map[string]string{"tag": "v1.0", "branch": "release"},
-		},
-		{
-			name:   "empty map",
-			refMap: map[string]string{},
-		},
-		{
-			name:    "invalid key",
-			refMap:  map[string]string{"digest": "sha256:abc"},
-			wantErr: true,
-		},
-		{
-			name:    "commit too short",
-			refMap:  map[string]string{"commit": "abc"},
-			wantErr: true,
-		},
-		{
-			name:    "commit not hex",
-			refMap:  map[string]string{"commit": "zzzzzzz"},
-			wantErr: true,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			err := validateGitRef(tt.refMap)
-			if tt.wantErr && err == nil {
-				t.Fatal("expected error, got nil")
-			}
-			if !tt.wantErr && err != nil {
-				t.Fatalf("unexpected error: %v", err)
-			}
-		})
-	}
-}
-
-func TestGenerateOCIRepository(t *testing.T) {
-	refMap := map[string]string{"tag": "v1.0", "digest": "sha256:abc123"}
-	obj, err := generateOCIRepository("my-repo", "oci://registry.example.com/repo", refMap)
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-
-	if obj.Name != "my-repo" {
-		t.Errorf("expected name %q, got %q", "my-repo", obj.Name)
-	}
-	if obj.Namespace != "cozy-system" {
-		t.Errorf("expected namespace %q, got %q", "cozy-system", obj.Namespace)
-	}
-	if obj.Spec.URL != "oci://registry.example.com/repo" {
-		t.Errorf("expected URL %q, got %q", "oci://registry.example.com/repo", obj.Spec.URL)
-	}
-	if obj.Spec.Reference == nil {
-		t.Fatal("expected Reference to be set")
-	}
-	if obj.Spec.Reference.Tag != "v1.0" {
-		t.Errorf("expected tag %q, got %q", "v1.0", obj.Spec.Reference.Tag)
-	}
-	if obj.Spec.Reference.Digest != "sha256:abc123" {
-		t.Errorf("expected digest %q, got %q", "sha256:abc123", obj.Spec.Reference.Digest)
-	}
-}
-
-func TestGenerateOCIRepository_NoRef(t *testing.T) {
-	obj, err := generateOCIRepository("my-repo", "oci://registry.example.com/repo", map[string]string{})
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	if obj.Spec.Reference != nil {
-		t.Error("expected Reference to be nil for empty refMap")
-	}
-}
-
-func TestGenerateOCIRepository_InvalidRef(t *testing.T) {
-	_, err := generateOCIRepository("my-repo", "oci://registry.example.com/repo", map[string]string{"branch": "main"})
-	if err == nil {
-		t.Fatal("expected error for invalid OCI ref key, got nil")
-	}
-}
-
-func TestGenerateGitRepository(t *testing.T) {
-	refMap := map[string]string{"branch": "main", "commit": "abc1234def5678"}
-	obj, err := generateGitRepository("my-repo", "https://github.com/user/repo", refMap)
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-
-	if obj.Name != "my-repo" {
-		t.Errorf("expected name %q, got %q", "my-repo", obj.Name)
-	}
-	if obj.Namespace != "cozy-system" {
-		t.Errorf("expected namespace %q, got %q", "cozy-system", obj.Namespace)
-	}
-	if obj.Spec.URL != "https://github.com/user/repo" {
-		t.Errorf("expected URL %q, got %q", "https://github.com/user/repo", obj.Spec.URL)
-	}
-	if obj.Spec.Reference == nil {
-		t.Fatal("expected Reference to be set")
-	}
-	if obj.Spec.Reference.Branch != "main" {
-		t.Errorf("expected branch %q, got %q", "main", obj.Spec.Reference.Branch)
-	}
-	if obj.Spec.Reference.Commit != "abc1234def5678" {
-		t.Errorf("expected commit %q, got %q", "abc1234def5678", obj.Spec.Reference.Commit)
-	}
-}
-
-func TestGenerateGitRepository_NoRef(t *testing.T) {
-	obj, err := generateGitRepository("my-repo", "https://github.com/user/repo", map[string]string{})
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	if obj.Spec.Reference != nil {
-		t.Error("expected Reference to be nil for empty refMap")
-	}
-}
-
-func TestGenerateGitRepository_InvalidRef(t *testing.T) {
-	_, err := generateGitRepository("my-repo", "https://github.com/user/repo", map[string]string{"digest": "sha256:abc"})
-	if err == nil {
-		t.Fatal("expected error for invalid Git ref key, got nil")
-	}
-}

cmd/kubeovn-plunger/main.go

@@ -29,7 +29,6 @@ import (
 	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
 	clientgoscheme "k8s.io/client-go/kubernetes/scheme"
 	ctrl "sigs.k8s.io/controller-runtime"
-	"sigs.k8s.io/controller-runtime/pkg/cache"
 	"sigs.k8s.io/controller-runtime/pkg/healthz"
 	"sigs.k8s.io/controller-runtime/pkg/log/zap"
 	"sigs.k8s.io/controller-runtime/pkg/metrics"
@@ -132,11 +131,6 @@ func main() {
 		HealthProbeBindAddress: probeAddr,
 		LeaderElection:         enableLeaderElection,
 		LeaderElectionID:       "29a0338b.cozystack.io",
-		Cache: cache.Options{
-			DefaultNamespaces: map[string]cache.Config{
-				kubeOVNNamespace: {},
-			},
-		},
 		// LeaderElectionReleaseOnCancel defines if the leader should step down voluntarily
 		// when the Manager ends. This requires the binary to immediately end when the
 		// Manager is stopped, otherwise, this setting is unsafe. Setting this significantly

dashboards/gpu/gpu-efficiency.json

@@ -1,819 +0,0 @@
-{
-  "uid": "gpu-efficiency",
-  "title": "GPU Efficiency Score",
-  "description": "Tensor saturation, util/watt and throttling — reveals inefficient GPU workloads",
-  "tags": [
-    "gpu",
-    "efficiency",
-    "finops"
-  ],
-  "timezone": "browser",
-  "editable": true,
-  "graphTooltip": 1,
-  "time": {
-    "from": "now-1h",
-    "to": "now"
-  },
-  "fiscalYearStartMonth": 0,
-  "schemaVersion": 42,
-  "panels": [
-    {
-      "type": "row",
-      "collapsed": false,
-      "title": "Overall efficiency metrics",
-      "gridPos": {
-        "h": 1,
-        "w": 24,
-        "x": 0,
-        "y": 0
-      },
-      "id": 1,
-      "panels": []
-    },
-    {
-      "type": "stat",
-      "id": 2,
-      "targets": [
-        {
-          "expr": "avg(gpu:tensor_saturation:avg5m) * 100",
-          "refId": "A"
-        }
-      ],
-      "title": "Avg Tensor Saturation",
-      "description": "Mean tensor core saturation across all GPUs. \u003c10% means GPUs are used inefficiently (workloads could move to CPU or optimize their code). Cluster-wide — DCGM metrics cannot be attributed to workload namespaces.",
-      "transparent": false,
-      "datasource": {
-        "type": "prometheus",
-        "uid": "$ds_prometheus"
-      },
-      "gridPos": {
-        "h": 5,
-        "w": 8,
-        "x": 0,
-        "y": 1
-      },
-      "repeatDirection": "h",
-      "options": {
-        "graphMode": "area",
-        "colorMode": "background",
-        "justifyMode": "auto",
-        "textMode": "value",
-        "wideLayout": true,
-        "showPercentChange": false,
-        "reduceOptions": {
-          "calcs": [
-            "lastNotNull"
-          ]
-        },
-        "percentChangeColorMode": "standard",
-        "orientation": ""
-      },
-      "fieldConfig": {
-        "defaults": {
-          "unit": "percent",
-          "min": 0,
-          "max": 100,
-          "thresholds": {
-            "mode": "absolute",
-            "steps": [
-              {
-                "value": null,
-                "color": "red"
-              },
-              {
-                "value": 10,
-                "color": "orange"
-              },
-              {
-                "value": 30,
-                "color": "yellow"
-              },
-              {
-                "value": 60,
-                "color": "green"
-              }
-            ]
-          }
-        },
-        "overrides": []
-      }
-    },
-    {
-      "type": "stat",
-      "id": 3,
-      "targets": [
-        {
-          "expr": "avg(gpu:util_per_watt:avg5m)",
-          "refId": "A"
-        }
-      ],
-      "title": "Avg Utilization per Watt",
-      "description": "NVML utilization % per watt across all GPUs. Higher value = more efficient workload. Cluster-wide — DCGM metrics cannot be attributed to workload namespaces.",
-      "transparent": false,
-      "datasource": {
-        "type": "prometheus",
-        "uid": "$ds_prometheus"
-      },
-      "gridPos": {
-        "h": 5,
-        "w": 8,
-        "x": 8,
-        "y": 1
-      },
-      "repeatDirection": "h",
-      "options": {
-        "graphMode": "area",
-        "colorMode": "background",
-        "justifyMode": "auto",
-        "textMode": "value",
-        "wideLayout": true,
-        "showPercentChange": false,
-        "reduceOptions": {
-          "calcs": [
-            "lastNotNull"
-          ]
-        },
-        "percentChangeColorMode": "standard",
-        "orientation": ""
-      },
-      "fieldConfig": {
-        "defaults": {
-          "unit": "none",
-          "decimals": 3,
-          "thresholds": {
-            "mode": "absolute",
-            "steps": [
-              {
-                "value": null,
-                "color": "red"
-              },
-              {
-                "value": 0.5,
-                "color": "yellow"
-              },
-              {
-                "value": 1,
-                "color": "green"
-              }
-            ]
-          }
-        },
-        "overrides": []
-      }
-    },
-    {
-      "type": "stat",
-      "id": 4,
-      "targets": [
-        {
-          "expr": "avg(gpu:power_throttle_fraction:rate5m)",
-          "refId": "A"
-        }
-      ],
-      "title": "Avg Power Throttling",
-      "description": "Fraction of time GPUs hit the TDP cap and lose performance. \u003e5% means tenants underutilize billed FLOPS. Cluster-wide — rule aggregates by (Hostname, gpu, UUID) and drops namespace label.",
-      "transparent": false,
-      "datasource": {
-        "type": "prometheus",
-        "uid": "$ds_prometheus"
-      },
-      "gridPos": {
-        "h": 5,
-        "w": 8,
-        "x": 16,
-        "y": 1
-      },
-      "repeatDirection": "h",
-      "options": {
-        "graphMode": "area",
-        "colorMode": "background",
-        "justifyMode": "auto",
-        "textMode": "value",
-        "wideLayout": true,
-        "showPercentChange": false,
-        "reduceOptions": {
-          "calcs": [
-            "lastNotNull"
-          ]
-        },
-        "percentChangeColorMode": "standard",
-        "orientation": ""
-      },
-      "fieldConfig": {
-        "defaults": {
-          "unit": "percentunit",
-          "decimals": 2,
-          "thresholds": {
-            "mode": "absolute",
-            "steps": [
-              {
-                "value": null,
-                "color": "green"
-              },
-              {
-                "value": 0.05,
-                "color": "yellow"
-              },
-              {
-                "value": 0.2,
-                "color": "red"
-              }
-            ]
-          }
-        },
-        "overrides": []
-      }
-    },
-    {
-      "type": "row",
-      "collapsed": false,
-      "title": "NVML vs Tensor (mismatch detector)",
-      "gridPos": {
-        "h": 1,
-        "w": 24,
-        "x": 0,
-        "y": 6
-      },
-      "id": 10,
-      "panels": []
-    },
-    {
-      "type": "timeseries",
-      "id": 11,
-      "targets": [
-        {
-          "expr": "DCGM_FI_DEV_GPU_UTIL",
-          "legendFormat": "{{Hostname}}/{{gpu}}",
-          "refId": "A"
-        }
-      ],
-      "title": "NVML GPU Utilization",
-      "description": "Classic utilization metric. Shows activity of any engine (SM, copy, encoder). Cluster-wide — DCGM namespace is the exporter's own namespace, not the workload namespace.",
-      "transparent": false,
-      "datasource": {
-        "type": "prometheus",
-        "uid": "$ds_prometheus"
-      },
-      "gridPos": {
-        "h": 8,
-        "w": 12,
-        "x": 0,
-        "y": 7
-      },
-      "repeatDirection": "h",
-      "options": {
-        "legend": {
-          "displayMode": "table",
-          "placement": "bottom",
-          "showLegend": false,
-          "calcs": [
-            "mean",
-            "max"
-          ]
-        },
-        "tooltip": {
-          "mode": "multi",
-          "sort": ""
-        }
-      },
-      "fieldConfig": {
-        "defaults": {
-          "unit": "percent",
-          "min": 0,
-          "max": 100,
-          "custom": {
-            "drawStyle": "line",
-            "lineInterpolation": "linear",
-            "fillOpacity": 10,
-            "showPoints": "never"
-          }
-        },
-        "overrides": []
-      }
-    },
-    {
-      "type": "timeseries",
-      "id": 12,
-      "targets": [
-        {
-          "expr": "DCGM_FI_PROF_PIPE_TENSOR_ACTIVE * 100",
-          "legendFormat": "{{Hostname}}/{{gpu}}",
-          "refId": "A"
-        }
-      ],
-      "title": "Tensor Pipe Active",
-      "description": "Real tensor core load (HMMA). For AI/LLM inference it should be ≥20%, otherwise the workload is unoptimized. Cluster-wide — DCGM namespace is the exporter's own namespace, not the workload namespace.",
-      "transparent": false,
-      "datasource": {
-        "type": "prometheus",
-        "uid": "$ds_prometheus"
-      },
-      "gridPos": {
-        "h": 8,
-        "w": 12,
-        "x": 12,
-        "y": 7
-      },
-      "repeatDirection": "h",
-      "options": {
-        "legend": {
-          "displayMode": "table",
-          "placement": "bottom",
-          "showLegend": false,
-          "calcs": [
-            "mean",
-            "max"
-          ]
-        },
-        "tooltip": {
-          "mode": "multi",
-          "sort": ""
-        }
-      },
-      "fieldConfig": {
-        "defaults": {
-          "unit": "percent",
-          "min": 0,
-          "max": 100,
-          "custom": {
-            "drawStyle": "line",
-            "lineInterpolation": "linear",
-            "fillOpacity": 10,
-            "showPoints": "never"
-          }
-        },
-        "overrides": []
-      }
-    },
-    {
-      "type": "row",
-      "collapsed": false,
-      "title": "Per-GPU ranking",
-      "gridPos": {
-        "h": 1,
-        "w": 24,
-        "x": 0,
-        "y": 15
-      },
-      "id": 20,
-      "panels": []
-    },
-    {
-      "type": "table",
-      "id": 21,
-      "targets": [
-        {
-          "expr": "topk(20, gpu:tensor_saturation:avg5m * 100)",
-          "instant": true,
-          "range": false,
-          "format": "table",
-          "refId": "A"
-        }
-      ],
-      "title": "Tensor Saturation per GPU (5m avg)",
-      "description": "Which GPUs are exercising tensor cores and which are not. Sorted descending. Grouped by Hostname/gpu/UUID — DCGM metrics cannot be attributed to workload namespaces.",
-      "transparent": false,
-      "datasource": {
-        "type": "prometheus",
-        "uid": "$ds_prometheus"
-      },
-      "gridPos": {
-        "h": 8,
-        "w": 12,
-        "x": 0,
-        "y": 16
-      },
-      "repeatDirection": "h",
-      "transformations": [
-        {
-          "id": "organize",
-          "options": {
-            "excludeByName": {
-              "DCGM_FI_DRIVER_VERSION": true,
-              "Time": true,
-              "__name__": true,
-              "cluster": true,
-              "container": true,
-              "device": true,
-              "endpoint": true,
-              "gpu_driver_version": true,
-              "instance": true,
-              "job": true,
-              "modelName": true,
-              "namespace": true,
-              "pci_bus_id": true,
-              "pod": true,
-              "prometheus": true,
-              "service": true,
-              "tenant": true,
-              "tier": true,
-              "uid": true,
-              "unit": true
-            },
-            "indexByName": {
-              "Hostname": 0,
-              "UUID": 2,
-              "Value": 3,
-              "gpu": 1
-            },
-            "renameByName": {
-              "Hostname": "Node",
-              "UUID": "UUID",
-              "Value": "Saturation",
-              "gpu": "GPU"
-            }
-          }
-        }
-      ],
-      "options": {
-        "frameIndex": 0,
-        "showHeader": true,
-        "showTypeIcons": false,
-        "sortBy": [
-          {
-            "displayName": "Saturation",
-            "desc": true
-          }
-        ],
-        "footer": {
-          "show": false,
-          "reducer": []
-        },
-        "cellHeight": "sm"
-      },
-      "fieldConfig": {
-        "defaults": {},
-        "overrides": [
-          {
-            "matcher": {
-              "id": "byName",
-              "options": "Saturation"
-            },
-            "properties": [
-              {
-                "id": "unit",
-                "value": "percent"
-              },
-              {
-                "id": "min",
-                "value": 0
-              },
-              {
-                "id": "max",
-                "value": 100
-              },
-              {
-                "id": "custom.cellOptions",
-                "value": {
-                  "mode": "gradient",
-                  "type": "gauge"
-                }
-              },
-              {
-                "id": "thresholds",
-                "value": {
-                  "mode": "absolute",
-                  "steps": [
-                    {
-                      "color": "red"
-                    },
-                    {
-                      "color": "orange",
-                      "value": 10
-                    },
-                    {
-                      "color": "yellow",
-                      "value": 30
-                    },
-                    {
-                      "color": "green",
-                      "value": 60
-                    }
-                  ]
-                }
-              }
-            ]
-          }
-        ]
-      }
-    },
-    {
-      "type": "table",
-      "id": 22,
-      "targets": [
-        {
-          "expr": "topk(20, gpu:util_per_watt:avg5m)",
-          "instant": true,
-          "range": false,
-          "format": "table",
-          "refId": "A"
-        }
-      ],
-      "title": "Utilization / Watt per GPU (5m avg)",
-      "description": "How efficiently each GPU spends watts. Low value = poor optimization. Grouped by Hostname/gpu/UUID — DCGM metrics cannot be attributed to workload namespaces.",
-      "transparent": false,
-      "datasource": {
-        "type": "prometheus",
-        "uid": "$ds_prometheus"
-      },
-      "gridPos": {
-        "h": 8,
-        "w": 12,
-        "x": 12,
-        "y": 16
-      },
-      "repeatDirection": "h",
-      "transformations": [
-        {
-          "id": "organize",
-          "options": {
-            "excludeByName": {
-              "DCGM_FI_DRIVER_VERSION": true,
-              "Time": true,
-              "__name__": true,
-              "cluster": true,
-              "container": true,
-              "device": true,
-              "endpoint": true,
-              "gpu_driver_version": true,
-              "instance": true,
-              "job": true,
-              "modelName": true,
-              "namespace": true,
-              "pci_bus_id": true,
-              "pod": true,
-              "prometheus": true,
-              "service": true,
-              "tenant": true,
-              "tier": true,
-              "uid": true,
-              "unit": true
-            },
-            "indexByName": {
-              "Hostname": 0,
-              "UUID": 2,
-              "Value": 3,
-              "gpu": 1
-            },
-            "renameByName": {
-              "Hostname": "Node",
-              "UUID": "UUID",
-              "Value": "Util/Watt",
-              "gpu": "GPU"
-            }
-          }
-        }
-      ],
-      "options": {
-        "frameIndex": 0,
-        "showHeader": true,
-        "showTypeIcons": false,
-        "sortBy": [
-          {
-            "displayName": "Util/Watt",
-            "desc": true
-          }
-        ],
-        "footer": {
-          "show": false,
-          "reducer": []
-        },
-        "cellHeight": "sm"
-      },
-      "fieldConfig": {
-        "defaults": {},
-        "overrides": [
-          {
-            "matcher": {
-              "id": "byName",
-              "options": "Util/Watt"
-            },
-            "properties": [
-              {
-                "id": "unit",
-                "value": "none"
-              },
-              {
-                "id": "decimals",
-                "value": 3
-              },
-              {
-                "id": "min",
-                "value": 0
-              },
-              {
-                "id": "max",
-                "value": 1.5
-              },
-              {
-                "id": "custom.cellOptions",
-                "value": {
-                  "mode": "gradient",
-                  "type": "gauge"
-                }
-              },
-              {
-                "id": "thresholds",
-                "value": {
-                  "mode": "absolute",
-                  "steps": [
-                    {
-                      "color": "red"
-                    },
-                    {
-                      "color": "yellow",
-                      "value": 0.5
-                    },
-                    {
-                      "color": "green",
-                      "value": 1
-                    }
-                  ]
-                }
-              }
-            ]
-          }
-        ]
-      }
-    },
-    {
-      "type": "row",
-      "collapsed": false,
-      "title": "Throttling",
-      "gridPos": {
-        "h": 1,
-        "w": 24,
-        "x": 0,
-        "y": 24
-      },
-      "id": 30,
-      "panels": []
-    },
-    {
-      "type": "timeseries",
-      "id": 31,
-      "targets": [
-        {
-          "expr": "gpu:power_throttle_fraction:rate5m",
-          "legendFormat": "{{Hostname}}/{{gpu}}",
-          "refId": "A"
-        }
-      ],
-      "title": "Power throttle fraction per GPU",
-      "description": "Fraction of time the GPU was power-throttled. 1.0 = always throttled. Cluster-wide — rule aggregates by (Hostname, gpu, UUID) and drops namespace label.",
-      "transparent": false,
-      "datasource": {
-        "type": "prometheus",
-        "uid": "$ds_prometheus"
-      },
-      "gridPos": {
-        "h": 8,
-        "w": 12,
-        "x": 0,
-        "y": 25
-      },
-      "repeatDirection": "h",
-      "options": {
-        "legend": {
-          "displayMode": "table",
-          "placement": "bottom",
-          "showLegend": false,
-          "calcs": [
-            "mean",
-            "max"
-          ]
-        },
-        "tooltip": {
-          "mode": "multi",
-          "sort": ""
-        }
-      },
-      "fieldConfig": {
-        "defaults": {
-          "unit": "percentunit",
-          "min": 0,
-          "max": 1,
-          "thresholds": {
-            "mode": "absolute",
-            "steps": [
-              {
-                "value": null,
-                "color": "green"
-              },
-              {
-                "value": 0.05,
-                "color": "yellow"
-              },
-              {
-                "value": 0.2,
-                "color": "red"
-              }
-            ]
-          },
-          "custom": {
-            "drawStyle": "line",
-            "lineInterpolation": "linear",
-            "fillOpacity": 25,
-            "showPoints": "never"
-          }
-        },
-        "overrides": []
-      }
-    },
-    {
-      "type": "timeseries",
-      "id": 32,
-      "targets": [
-        {
-          "expr": "gpu:thermal_throttle_fraction:rate5m",
-          "legendFormat": "{{Hostname}}/{{gpu}}",
-          "refId": "A"
-        }
-      ],
-      "title": "Thermal throttle fraction per GPU",
-      "description": "Fraction of time the GPU was thermal-throttled. Cluster-wide — rule aggregates by (Hostname, gpu, UUID) and drops namespace label.",
-      "transparent": false,
-      "datasource": {
-        "type": "prometheus",
-        "uid": "$ds_prometheus"
-      },
-      "gridPos": {
-        "h": 8,
-        "w": 12,
-        "x": 12,
-        "y": 25
-      },
-      "repeatDirection": "h",
-      "options": {
-        "legend": {
-          "displayMode": "table",
-          "placement": "bottom",
-          "showLegend": false,
-          "calcs": [
-            "mean",
-            "max"
-          ]
-        },
-        "tooltip": {
-          "mode": "multi",
-          "sort": ""
-        }
-      },
-      "fieldConfig": {
-        "defaults": {
-          "unit": "percentunit",
-          "min": 0,
-          "max": 1,
-          "thresholds": {
-            "mode": "absolute",
-            "steps": [
-              {
-                "value": null,
-                "color": "green"
-              },
-              {
-                "value": 0.05,
-                "color": "yellow"
-              },
-              {
-                "value": 0.2,
-                "color": "red"
-              }
-            ]
-          },
-          "custom": {
-            "drawStyle": "line",
-            "lineInterpolation": "linear",
-            "fillOpacity": 25,
-            "showPoints": "never"
-          }
-        },
-        "overrides": []
-      }
-    }
-  ],
-  "templating": {
-    "list": [
-      {
-        "type": "datasource",
-        "name": "ds_prometheus",
-        "label": "Prometheus",
-        "skipUrlSync": false,
-        "query": "prometheus",
-        "current": {
-          "selected": false,
-          "text": "default",
-          "value": "default"
-        },
-        "multi": false,
-        "allowCustomValue": true,
-        "includeAll": false,
-        "regex": "",
-        "auto": false,
-        "auto_min": "10s",
-        "auto_count": 30
-      }
-    ]
-  },
-  "annotations": {}
-}

dashboards/gpu/gpu-performance.json

@@ -1,957 +0,0 @@
-{
-  "uid": "gpu-performance",
-  "title": "GPU Performance",
-  "tags": [
-    "gpu",
-    "dcgm"
-  ],
-  "timezone": "browser",
-  "editable": true,
-  "graphTooltip": 1,
-  "time": {
-    "from": "now-1h",
-    "to": "now"
-  },
-  "fiscalYearStartMonth": 0,
-  "schemaVersion": 42,
-  "panels": [
-    {
-      "type": "row",
-      "collapsed": false,
-      "title": "Overview",
-      "gridPos": {
-        "h": 1,
-        "w": 24,
-        "x": 0,
-        "y": 0
-      },
-      "id": 1,
-      "panels": []
-    },
-    {
-      "type": "stat",
-      "id": 2,
-      "targets": [
-        {
-          "expr": "cluster:gpu_count:total",
-          "refId": "A"
-        }
-      ],
-      "title": "Total GPUs",
-      "transparent": false,
-      "datasource": {
-        "type": "prometheus",
-        "uid": "$ds_prometheus"
-      },
-      "gridPos": {
-        "h": 4,
-        "w": 6,
-        "x": 0,
-        "y": 1
-      },
-      "repeatDirection": "h",
-      "options": {
-        "graphMode": "none",
-        "colorMode": "value",
-        "justifyMode": "auto",
-        "textMode": "value",
-        "wideLayout": true,
-        "showPercentChange": false,
-        "reduceOptions": {
-          "calcs": [
-            "lastNotNull"
-          ]
-        },
-        "percentChangeColorMode": "standard",
-        "orientation": ""
-      },
-      "fieldConfig": {
-        "defaults": {
-          "unit": "short",
-          "thresholds": {
-            "mode": "absolute",
-            "steps": [
-              {
-                "value": null,
-                "color": "blue"
-              }
-            ]
-          }
-        },
-        "overrides": []
-      }
-    },
-    {
-      "type": "stat",
-      "id": 3,
-      "targets": [
-        {
-          "expr": "cluster:gpu_count:allocated",
-          "refId": "A"
-        }
-      ],
-      "title": "Allocated",
-      "transparent": false,
-      "datasource": {
-        "type": "prometheus",
-        "uid": "$ds_prometheus"
-      },
-      "gridPos": {
-        "h": 4,
-        "w": 6,
-        "x": 6,
-        "y": 1
-      },
-      "repeatDirection": "h",
-      "options": {
-        "graphMode": "none",
-        "colorMode": "value",
-        "justifyMode": "auto",
-        "textMode": "value",
-        "wideLayout": true,
-        "showPercentChange": false,
-        "reduceOptions": {
-          "calcs": [
-            "lastNotNull"
-          ]
-        },
-        "percentChangeColorMode": "standard",
-        "orientation": ""
-      },
-      "fieldConfig": {
-        "defaults": {
-          "unit": "short",
-          "thresholds": {
-            "mode": "absolute",
-            "steps": [
-              {
-                "value": null,
-                "color": "green"
-              },
-              {
-                "value": 1,
-                "color": "yellow"
-              }
-            ]
-          }
-        },
-        "overrides": []
-      }
-    },
-    {
-      "type": "stat",
-      "id": 4,
-      "targets": [
-        {
-          "expr": "cluster:gpu_util:avg",
-          "refId": "A"
-        }
-      ],
-      "title": "Average utilization",
-      "transparent": false,
-      "datasource": {
-        "type": "prometheus",
-        "uid": "$ds_prometheus"
-      },
-      "gridPos": {
-        "h": 4,
-        "w": 6,
-        "x": 12,
-        "y": 1
-      },
-      "repeatDirection": "h",
-      "options": {
-        "graphMode": "area",
-        "colorMode": "value",
-        "justifyMode": "auto",
-        "textMode": "value",
-        "wideLayout": true,
-        "showPercentChange": false,
-        "reduceOptions": {
-          "calcs": [
-            "lastNotNull"
-          ]
-        },
-        "percentChangeColorMode": "standard",
-        "orientation": ""
-      },
-      "fieldConfig": {
-        "defaults": {
-          "unit": "percent",
-          "min": 0,
-          "max": 100,
-          "thresholds": {
-            "mode": "absolute",
-            "steps": [
-              {
-                "value": null,
-                "color": "blue"
-              },
-              {
-                "value": 30,
-                "color": "green"
-              },
-              {
-                "value": 80,
-                "color": "orange"
-              }
-            ]
-          }
-        },
-        "overrides": []
-      }
-    },
-    {
-      "type": "stat",
-      "id": 5,
-      "targets": [
-        {
-          "expr": "cluster:gpu_power_watts:sum",
-          "refId": "A"
-        }
-      ],
-      "title": "Power draw",
-      "transparent": false,
-      "datasource": {
-        "type": "prometheus",
-        "uid": "$ds_prometheus"
-      },
-      "gridPos": {
-        "h": 4,
-        "w": 6,
-        "x": 18,
-        "y": 1
-      },
-      "repeatDirection": "h",
-      "options": {
-        "graphMode": "area",
-        "colorMode": "value",
-        "justifyMode": "auto",
-        "textMode": "value",
-        "wideLayout": true,
-        "showPercentChange": false,
-        "reduceOptions": {
-          "calcs": [
-            "lastNotNull"
-          ]
-        },
-        "percentChangeColorMode": "standard",
-        "orientation": ""
-      },
-      "fieldConfig": {
-        "defaults": {
-          "unit": "watt",
-          "decimals": 0,
-          "thresholds": {
-            "mode": "absolute",
-            "steps": [
-              {
-                "value": null,
-                "color": "green"
-              }
-            ]
-          }
-        },
-        "overrides": []
-      }
-    },
-    {
-      "type": "row",
-      "collapsed": false,
-      "title": "Utilization",
-      "gridPos": {
-        "h": 1,
-        "w": 24,
-        "x": 0,
-        "y": 5
-      },
-      "id": 10,
-      "panels": []
-    },
-    {
-      "type": "timeseries",
-      "id": 11,
-      "targets": [
-        {
-          "expr": "DCGM_FI_DEV_GPU_UTIL{Hostname=~\"$Hostname\"}",
-          "legendFormat": "{{Hostname}}/{{gpu}} {{pod}}",
-          "refId": "A"
-        }
-      ],
-      "title": "GPU Utilization (NVML)",
-      "transparent": false,
-      "datasource": {
-        "type": "prometheus",
-        "uid": "$ds_prometheus"
-      },
-      "gridPos": {
-        "h": 8,
-        "w": 12,
-        "x": 0,
-        "y": 6
-      },
-      "repeatDirection": "h",
-      "options": {
-        "legend": {
-          "displayMode": "table",
-          "placement": "bottom",
-          "showLegend": false,
-          "calcs": [
-            "mean",
-            "max"
-          ]
-        },
-        "tooltip": {
-          "mode": "multi",
-          "sort": ""
-        }
-      },
-      "fieldConfig": {
-        "defaults": {
-          "unit": "percent",
-          "min": 0,
-          "max": 100,
-          "custom": {
-            "drawStyle": "line",
-            "lineInterpolation": "linear",
-            "fillOpacity": 10,
-            "showPoints": "never",
-            "spanNulls": false
-          }
-        },
-        "overrides": []
-      }
-    },
-    {
-      "type": "timeseries",
-      "id": 12,
-      "targets": [
-        {
-          "expr": "DCGM_FI_PROF_PIPE_TENSOR_ACTIVE{Hostname=~\"$Hostname\"} * 100",
-          "legendFormat": "{{Hostname}}/{{gpu}} {{pod}}",
-          "refId": "A"
-        }
-      ],
-      "title": "Tensor Pipe Active (realistic load for LLM/AI)",
-      "transparent": false,
-      "datasource": {
-        "type": "prometheus",
-        "uid": "$ds_prometheus"
-      },
-      "gridPos": {
-        "h": 8,
-        "w": 12,
-        "x": 12,
-        "y": 6
-      },
-      "repeatDirection": "h",
-      "options": {
-        "legend": {
-          "displayMode": "table",
-          "placement": "bottom",
-          "showLegend": false,
-          "calcs": [
-            "mean",
-            "max"
-          ]
-        },
-        "tooltip": {
-          "mode": "multi",
-          "sort": ""
-        }
-      },
-      "fieldConfig": {
-        "defaults": {
-          "unit": "percent",
-          "min": 0,
-          "max": 100,
-          "custom": {
-            "drawStyle": "line",
-            "lineInterpolation": "linear",
-            "fillOpacity": 10,
-            "showPoints": "never",
-            "spanNulls": false
-          }
-        },
-        "overrides": []
-      }
-    },
-    {
-      "type": "timeseries",
-      "id": 13,
-      "targets": [
-        {
-          "expr": "DCGM_FI_PROF_GR_ENGINE_ACTIVE{Hostname=~\"$Hostname\"} * 100",
-          "legendFormat": "{{Hostname}}/{{gpu}} {{pod}}",
-          "refId": "A"
-        }
-      ],
-      "title": "Graphics Engine Active",
-      "transparent": false,
-      "datasource": {
-        "type": "prometheus",
-        "uid": "$ds_prometheus"
-      },
-      "gridPos": {
-        "h": 8,
-        "w": 12,
-        "x": 0,
-        "y": 14
-      },
-      "repeatDirection": "h",
-      "options": {
-        "legend": {
-          "displayMode": "table",
-          "placement": "bottom",
-          "showLegend": false,
-          "calcs": [
-            "mean",
-            "max"
-          ]
-        },
-        "tooltip": {
-          "mode": "multi",
-          "sort": ""
-        }
-      },
-      "fieldConfig": {
-        "defaults": {
-          "unit": "percent",
-          "min": 0,
-          "max": 100,
-          "custom": {
-            "drawStyle": "line",
-            "lineInterpolation": "linear",
-            "fillOpacity": 10,
-            "showPoints": "never",
-            "spanNulls": false
-          }
-        },
-        "overrides": []
-      }
-    },
-    {
-      "type": "timeseries",
-      "id": 14,
-      "targets": [
-        {
-          "expr": "DCGM_FI_DEV_MEM_COPY_UTIL{Hostname=~\"$Hostname\"}",
-          "legendFormat": "{{Hostname}}/{{gpu}} {{pod}}",
-          "refId": "A"
-        }
-      ],
-      "title": "Memory Copy Utilization",
-      "transparent": false,
-      "datasource": {
-        "type": "prometheus",
-        "uid": "$ds_prometheus"
-      },
-      "gridPos": {
-        "h": 8,
-        "w": 12,
-        "x": 12,
-        "y": 14
-      },
-      "repeatDirection": "h",
-      "options": {
-        "legend": {
-          "displayMode": "table",
-          "placement": "bottom",
-          "showLegend": false,
-          "calcs": [
-            "mean",
-            "max"
-          ]
-        },
-        "tooltip": {
-          "mode": "multi",
-          "sort": ""
-        }
-      },
-      "fieldConfig": {
-        "defaults": {
-          "unit": "percent",
-          "min": 0,
-          "max": 100,
-          "custom": {
-            "drawStyle": "line",
-            "lineInterpolation": "linear",
-            "fillOpacity": 10,
-            "showPoints": "never",
-            "spanNulls": false
-          }
-        },
-        "overrides": []
-      }
-    },
-    {
-      "type": "row",
-      "collapsed": false,
-      "title": "Memory",
-      "gridPos": {
-        "h": 1,
-        "w": 24,
-        "x": 0,
-        "y": 22
-      },
-      "id": 20,
-      "panels": []
-    },
-    {
-      "type": "timeseries",
-      "id": 21,
-      "targets": [
-        {
-          "expr": "DCGM_FI_DEV_FB_USED{Hostname=~\"$Hostname\"} * 1048576",
-          "legendFormat": "{{Hostname}}/{{gpu}} {{pod}}",
-          "refId": "A"
-        }
-      ],
-      "title": "VRAM Used",
-      "transparent": false,
-      "datasource": {
-        "type": "prometheus",
-        "uid": "$ds_prometheus"
-      },
-      "gridPos": {
-        "h": 8,
-        "w": 12,
-        "x": 0,
-        "y": 23
-      },
-      "repeatDirection": "h",
-      "options": {
-        "legend": {
-          "displayMode": "table",
-          "placement": "bottom",
-          "showLegend": false,
-          "calcs": [
-            "mean",
-            "max"
-          ]
-        },
-        "tooltip": {
-          "mode": "multi",
-          "sort": ""
-        }
-      },
-      "fieldConfig": {
-        "defaults": {
-          "unit": "bytes",
-          "custom": {
-            "drawStyle": "line",
-            "lineInterpolation": "linear",
-            "fillOpacity": 25,
-            "showPoints": "never"
-          }
-        },
-        "overrides": []
-      }
-    },
-    {
-      "type": "timeseries",
-      "id": 22,
-      "targets": [
-        {
-          "expr": "DCGM_FI_DEV_FB_FREE{Hostname=~\"$Hostname\"} * 1048576",
-          "legendFormat": "{{Hostname}}/{{gpu}}",
-          "refId": "A"
-        }
-      ],
-      "title": "VRAM Free",
-      "transparent": false,
-      "datasource": {
-        "type": "prometheus",
-        "uid": "$ds_prometheus"
-      },
-      "gridPos": {
-        "h": 8,
-        "w": 12,
-        "x": 12,
-        "y": 23
-      },
-      "repeatDirection": "h",
-      "options": {
-        "legend": {
-          "displayMode": "table",
-          "placement": "bottom",
-          "showLegend": false,
-          "calcs": [
-            "mean",
-            "min"
-          ]
-        },
-        "tooltip": {
-          "mode": "multi",
-          "sort": ""
-        }
-      },
-      "fieldConfig": {
-        "defaults": {
-          "unit": "bytes",
-          "custom": {
-            "drawStyle": "line",
-            "lineInterpolation": "linear",
-            "fillOpacity": 10,
-            "showPoints": "never"
-          }
-        },
-        "overrides": []
-      }
-    },
-    {
-      "type": "row",
-      "collapsed": false,
-      "title": "Power \u0026 Temperature",
-      "gridPos": {
-        "h": 1,
-        "w": 24,
-        "x": 0,
-        "y": 31
-      },
-      "id": 30,
-      "panels": []
-    },
-    {
-      "type": "timeseries",
-      "id": 31,
-      "targets": [
-        {
-          "expr": "DCGM_FI_DEV_POWER_USAGE{Hostname=~\"$Hostname\"}",
-          "legendFormat": "{{Hostname}}/{{gpu}}",
-          "refId": "A"
-        }
-      ],
-      "title": "Power Usage per GPU",
-      "description": "Hardware-level metric — shown cluster-wide regardless of namespace filter.",
-      "transparent": false,
-      "datasource": {
-        "type": "prometheus",
-        "uid": "$ds_prometheus"
-      },
-      "gridPos": {
-        "h": 8,
-        "w": 12,
-        "x": 0,
-        "y": 32
-      },
-      "repeatDirection": "h",
-      "options": {
-        "legend": {
-          "displayMode": "table",
-          "placement": "bottom",
-          "showLegend": false,
-          "calcs": [
-            "mean",
-            "max"
-          ]
-        },
-        "tooltip": {
-          "mode": "multi",
-          "sort": ""
-        }
-      },
-      "fieldConfig": {
-        "defaults": {
-          "unit": "watt",
-          "custom": {
-            "drawStyle": "line",
-            "lineInterpolation": "linear",
-            "fillOpacity": 10,
-            "showPoints": "never"
-          }
-        },
-        "overrides": []
-      }
-    },
-    {
-      "type": "timeseries",
-      "id": 32,
-      "targets": [
-        {
-          "expr": "DCGM_FI_DEV_GPU_TEMP{Hostname=~\"$Hostname\"}",
-          "legendFormat": "{{Hostname}}/{{gpu}}",
-          "refId": "A"
-        }
-      ],
-      "title": "GPU Temperature",
-      "description": "Hardware-level metric — shown cluster-wide regardless of namespace filter.",
-      "transparent": false,
-      "datasource": {
-        "type": "prometheus",
-        "uid": "$ds_prometheus"
-      },
-      "gridPos": {
-        "h": 8,
-        "w": 12,
-        "x": 12,
-        "y": 32
-      },
-      "repeatDirection": "h",
-      "options": {
-        "legend": {
-          "displayMode": "table",
-          "placement": "bottom",
-          "showLegend": false,
-          "calcs": [
-            "mean",
-            "max"
-          ]
-        },
-        "tooltip": {
-          "mode": "multi",
-          "sort": ""
-        }
-      },
-      "fieldConfig": {
-        "defaults": {
-          "unit": "celsius",
-          "min": 20,
-          "max": 100,
-          "thresholds": {
-            "mode": "absolute",
-            "steps": [
-              {
-                "value": null,
-                "color": "green"
-              },
-              {
-                "value": 75,
-                "color": "yellow"
-              },
-              {
-                "value": 85,
-                "color": "red"
-              }
-            ]
-          },
-          "custom": {
-            "drawStyle": "line",
-            "lineInterpolation": "linear",
-            "fillOpacity": 10,
-            "showPoints": "never"
-          }
-        },
-        "overrides": []
-      }
-    },
-    {
-      "type": "row",
-      "collapsed": false,
-      "title": "Health",
-      "gridPos": {
-        "h": 1,
-        "w": 24,
-        "x": 0,
-        "y": 40
-      },
-      "id": 40,
-      "panels": []
-    },
-    {
-      "type": "stat",
-      "id": 41,
-      "targets": [
-        {
-          "expr": "max by (Hostname, gpu) (DCGM_FI_DEV_XID_ERRORS{Hostname=~\"$Hostname\"})",
-          "legendFormat": "{{Hostname}}/{{gpu}}",
-          "refId": "A"
-        }
-      ],
-      "title": "XID errors (latest)",
-      "description": "Hardware-level metric — shown cluster-wide regardless of namespace filter.",
-      "transparent": false,
-      "datasource": {
-        "type": "prometheus",
-        "uid": "$ds_prometheus"
-      },
-      "gridPos": {
-        "h": 5,
-        "w": 8,
-        "x": 0,
-        "y": 41
-      },
-      "repeatDirection": "h",
-      "options": {
-        "graphMode": "none",
-        "colorMode": "background",
-        "justifyMode": "auto",
-        "textMode": "value_and_name",
-        "wideLayout": true,
-        "showPercentChange": false,
-        "reduceOptions": {
-          "calcs": [
-            "lastNotNull"
-          ]
-        },
-        "percentChangeColorMode": "standard",
-        "orientation": ""
-      },
-      "fieldConfig": {
-        "defaults": {
-          "unit": "short",
-          "thresholds": {
-            "mode": "absolute",
-            "steps": [
-              {
-                "value": null,
-                "color": "green"
-              },
-              {
-                "value": 1,
-                "color": "red"
-              }
-            ]
-          }
-        },
-        "overrides": []
-      }
-    },
-    {
-      "type": "timeseries",
-      "id": 42,
-      "targets": [
-        {
-          "expr": "rate(DCGM_FI_DEV_POWER_VIOLATION{Hostname=~\"$Hostname\"}[5m])",
-          "legendFormat": "{{Hostname}}/{{gpu}}",
-          "refId": "A"
-        }
-      ],
-      "title": "Power Violation (µs/s throttled due to power)",
-      "description": "Hardware-level metric — shown cluster-wide regardless of namespace filter.",
-      "transparent": false,
-      "datasource": {
-        "type": "prometheus",
-        "uid": "$ds_prometheus"
-      },
-      "gridPos": {
-        "h": 5,
-        "w": 8,
-        "x": 8,
-        "y": 41
-      },
-      "repeatDirection": "h",
-      "options": {
-        "legend": {
-          "displayMode": "list",
-          "placement": "bottom",
-          "showLegend": false,
-          "calcs": []
-        },
-        "tooltip": {
-          "mode": "multi",
-          "sort": ""
-        }
-      },
-      "fieldConfig": {
-        "defaults": {
-          "unit": "µs",
-          "custom": {
-            "drawStyle": "line",
-            "lineInterpolation": "linear",
-            "fillOpacity": 10,
-            "showPoints": "never"
-          }
-        },
-        "overrides": []
-      }
-    },
-    {
-      "type": "timeseries",
-      "id": 43,
-      "targets": [
-        {
-          "expr": "rate(DCGM_FI_DEV_THERMAL_VIOLATION{Hostname=~\"$Hostname\"}[5m])",
-          "legendFormat": "{{Hostname}}/{{gpu}}",
-          "refId": "A"
-        }
-      ],
-      "title": "Thermal Violation (µs/s throttled due to thermals)",
-      "description": "Hardware-level metric — shown cluster-wide regardless of namespace filter.",
-      "transparent": false,
-      "datasource": {
-        "type": "prometheus",
-        "uid": "$ds_prometheus"
-      },
-      "gridPos": {
-        "h": 5,
-        "w": 8,
-        "x": 16,
-        "y": 41
-      },
-      "repeatDirection": "h",
-      "options": {
-        "legend": {
-          "displayMode": "list",
-          "placement": "bottom",
-          "showLegend": false,
-          "calcs": []
-        },
-        "tooltip": {
-          "mode": "multi",
-          "sort": ""
-        }
-      },
-      "fieldConfig": {
-        "defaults": {
-          "unit": "µs",
-          "custom": {
-            "drawStyle": "line",
-            "lineInterpolation": "linear",
-            "fillOpacity": 10,
-            "showPoints": "never"
-          }
-        },
-        "overrides": []
-      }
-    }
-  ],
-  "templating": {
-    "list": [
-      {
-        "type": "datasource",
-        "name": "ds_prometheus",
-        "label": "Prometheus",
-        "skipUrlSync": false,
-        "query": "prometheus",
-        "current": {
-          "selected": false,
-          "text": "default",
-          "value": "default"
-        },
-        "multi": false,
-        "allowCustomValue": true,
-        "includeAll": false,
-        "regex": "",
-        "auto": false,
-        "auto_min": "10s",
-        "auto_count": 30
-      },
-      {
-        "type": "query",
-        "name": "Hostname",
-        "label": "Host",
-        "skipUrlSync": false,
-        "query": "label_values(DCGM_FI_DEV_GPU_UTIL, Hostname)",
-        "datasource": {
-          "type": "prometheus",
-          "uid": "$ds_prometheus"
-        },
-        "current": {
-          "selected": true,
-          "text": "All",
-          "value": "$__all"
-        },
-        "multi": true,
-        "allowCustomValue": true,
-        "refresh": 2,
-        "sort": 1,
-        "includeAll": true,
-        "auto": false,
-        "auto_min": "10s",
-        "auto_count": 30
-      }
-    ]
-  },
-  "annotations": {}
-}

dashboards/gpu/gpu-quotas.json

@@ -1,637 +0,0 @@
-{
-  "uid": "gpu-quotas",
-  "title": "GPU Quotas \u0026 Allocation",
-  "tags": [
-    "gpu",
-    "quotas"
-  ],
-  "timezone": "browser",
-  "editable": true,
-  "graphTooltip": 1,
-  "time": {
-    "from": "now-6h",
-    "to": "now"
-  },
-  "fiscalYearStartMonth": 0,
-  "schemaVersion": 42,
-  "panels": [
-    {
-      "type": "row",
-      "collapsed": false,
-      "title": "Allocation overview",
-      "gridPos": {
-        "h": 1,
-        "w": 24,
-        "x": 0,
-        "y": 0
-      },
-      "id": 1,
-      "panels": []
-    },
-    {
-      "type": "stat",
-      "id": 2,
-      "targets": [
-        {
-          "expr": "sum(kube_node_status_allocatable{resource=\"nvidia_com_gpu\"})",
-          "refId": "A"
-        }
-      ],
-      "title": "GPU allocatable",
-      "description": "Total GPU capacity the cluster can schedule to pods.",
-      "transparent": false,
-      "datasource": {
-        "type": "prometheus",
-        "uid": "$ds_prometheus"
-      },
-      "gridPos": {
-        "h": 4,
-        "w": 6,
-        "x": 0,
-        "y": 1
-      },
-      "repeatDirection": "h",
-      "options": {
-        "graphMode": "none",
-        "colorMode": "value",
-        "justifyMode": "auto",
-        "textMode": "value",
-        "wideLayout": true,
-        "showPercentChange": false,
-        "reduceOptions": {
-          "calcs": [
-            "lastNotNull"
-          ]
-        },
-        "percentChangeColorMode": "standard",
-        "orientation": ""
-      },
-      "fieldConfig": {
-        "defaults": {
-          "unit": "short",
-          "thresholds": {
-            "mode": "absolute",
-            "steps": [
-              {
-                "value": null,
-                "color": "blue"
-              }
-            ]
-          }
-        },
-        "overrides": []
-      }
-    },
-    {
-      "type": "stat",
-      "id": 3,
-      "targets": [
-        {
-          "expr": "cluster:gpu_count:allocated",
-          "refId": "A"
-        }
-      ],
-      "title": "GPU requested",
-      "description": "Sum of GPU requests across all pods cluster-wide, including system namespaces.",
-      "transparent": false,
-      "datasource": {
-        "type": "prometheus",
-        "uid": "$ds_prometheus"
-      },
-      "gridPos": {
-        "h": 4,
-        "w": 6,
-        "x": 6,
-        "y": 1
-      },
-      "repeatDirection": "h",
-      "options": {
-        "graphMode": "none",
-        "colorMode": "value",
-        "justifyMode": "auto",
-        "textMode": "value",
-        "wideLayout": true,
-        "showPercentChange": false,
-        "reduceOptions": {
-          "calcs": [
-            "lastNotNull"
-          ]
-        },
-        "percentChangeColorMode": "standard",
-        "orientation": ""
-      },
-      "fieldConfig": {
-        "defaults": {
-          "unit": "short",
-          "thresholds": {
-            "mode": "absolute",
-            "steps": [
-              {
-                "value": null,
-                "color": "green"
-              },
-              {
-                "value": 1,
-                "color": "yellow"
-              }
-            ]
-          }
-        },
-        "overrides": []
-      }
-    },
-    {
-      "type": "gauge",
-      "id": 4,
-      "targets": [
-        {
-          "expr": "cluster:gpu_count:allocated / sum(kube_node_status_allocatable{resource=\"nvidia_com_gpu\"}) * 100",
-          "refId": "A"
-        }
-      ],
-      "title": "Allocation ratio",
-      "description": "Percentage of allocatable GPUs currently requested by pods.",
-      "transparent": false,
-      "datasource": {
-        "type": "prometheus",
-        "uid": "$ds_prometheus"
-      },
-      "gridPos": {
-        "h": 4,
-        "w": 6,
-        "x": 12,
-        "y": 1
-      },
-      "repeatDirection": "h",
-      "options": {
-        "showThresholdLabels": false,
-        "showThresholdMarkers": true,
-        "sizing": "auto",
-        "minVizWidth": 75,
-        "reduceOptions": {
-          "calcs": [
-            "lastNotNull"
-          ]
-        },
-        "minVizHeight": 75,
-        "orientation": ""
-      },
-      "fieldConfig": {
-        "defaults": {
-          "unit": "percent",
-          "min": 0,
-          "max": 100,
-          "thresholds": {
-            "mode": "absolute",
-            "steps": [
-              {
-                "value": null,
-                "color": "blue"
-              },
-              {
-                "value": 40,
-                "color": "green"
-              },
-              {
-                "value": 80,
-                "color": "yellow"
-              },
-              {
-                "value": 95,
-                "color": "red"
-              }
-            ]
-          }
-        },
-        "overrides": []
-      }
-    },
-    {
-      "type": "stat",
-      "id": 5,
-      "targets": [
-        {
-          "expr": "count((sum by (namespace, pod) (kube_pod_container_resource_requests{resource=\"nvidia_com_gpu\"}) \u003e 0) * on(namespace, pod) group_left() (kube_pod_status_phase{phase=\"Pending\"} == 1)) or vector(0)",
-          "refId": "A"
-        }
-      ],
-      "title": "Pending pods (GPU)",
-      "description": "Pods requesting GPUs that are stuck in Pending state — indicates capacity shortage.",
-      "transparent": false,
-      "datasource": {
-        "type": "prometheus",
-        "uid": "$ds_prometheus"
-      },
-      "gridPos": {
-        "h": 4,
-        "w": 6,
-        "x": 18,
-        "y": 1
-      },
-      "repeatDirection": "h",
-      "options": {
-        "graphMode": "none",
-        "colorMode": "background",
-        "justifyMode": "auto",
-        "textMode": "value",
-        "wideLayout": true,
-        "showPercentChange": false,
-        "reduceOptions": {
-          "calcs": [
-            "lastNotNull"
-          ]
-        },
-        "percentChangeColorMode": "standard",
-        "orientation": ""
-      },
-      "fieldConfig": {
-        "defaults": {
-          "unit": "short",
-          "thresholds": {
-            "mode": "absolute",
-            "steps": [
-              {
-                "value": null,
-                "color": "green"
-              },
-              {
-                "value": 1,
-                "color": "red"
-              }
-            ]
-          }
-        },
-        "overrides": []
-      }
-    },
-    {
-      "type": "row",
-      "collapsed": false,
-      "title": "Per namespace",
-      "gridPos": {
-        "h": 1,
-        "w": 24,
-        "x": 0,
-        "y": 5
-      },
-      "id": 10,
-      "panels": []
-    },
-    {
-      "type": "bargauge",
-      "id": 11,
-      "targets": [
-        {
-          "expr": "sum by (namespace) (namespace:gpu_count:allocated{namespace=~\"$namespace\"})",
-          "legendFormat": "{{namespace}}",
-          "refId": "A"
-        }
-      ],
-      "title": "GPU requested per namespace",
-      "description": "GPU allocation breakdown by namespace — spot top consumers at a glance.",
-      "transparent": false,
-      "datasource": {
-        "type": "prometheus",
-        "uid": "$ds_prometheus"
-      },
-      "gridPos": {
-        "h": 8,
-        "w": 12,
-        "x": 0,
-        "y": 6
-      },
-      "repeatDirection": "h",
-      "options": {
-        "displayMode": "gradient",
-        "valueMode": "color",
-        "namePlacement": "auto",
-        "showUnfilled": true,
-        "sizing": "auto",
-        "minVizWidth": 8,
-        "minVizHeight": 16,
-        "legend": {
-          "displayMode": "list",
-          "placement": "bottom",
-          "showLegend": false,
-          "calcs": []
-        },
-        "reduceOptions": {
-          "calcs": [
-            "lastNotNull"
-          ]
-        },
-        "maxVizHeight": 300,
-        "orientation": "horizontal"
-      },
-      "fieldConfig": {
-        "defaults": {
-          "unit": "short",
-          "min": 0,
-          "max": 8,
-          "thresholds": {
-            "mode": "absolute",
-            "steps": [
-              {
-                "value": null,
-                "color": "green"
-              }
-            ]
-          }
-        },
-        "overrides": []
-      }
-    },
-    {
-      "type": "timeseries",
-      "id": 12,
-      "targets": [
-        {
-          "expr": "sum(kube_node_status_allocatable{resource=\"nvidia_com_gpu\"})",
-          "legendFormat": "Allocatable (total)",
-          "refId": "A"
-        },
-        {
-          "expr": "sum(namespace:gpu_count:allocated{namespace=~\"$namespace\"})",
-          "legendFormat": "Requested",
-          "refId": "B"
-        }
-      ],
-      "title": "GPU allocated over time",
-      "description": "Requested vs allocatable GPUs over time — shows allocation pressure trends.",
-      "transparent": false,
-      "datasource": {
-        "type": "prometheus",
-        "uid": "$ds_prometheus"
-      },
-      "gridPos": {
-        "h": 8,
-        "w": 12,
-        "x": 12,
-        "y": 6
-      },
-      "repeatDirection": "h",
-      "options": {
-        "legend": {
-          "displayMode": "list",
-          "placement": "bottom",
-          "showLegend": false,
-          "calcs": []
-        },
-        "tooltip": {
-          "mode": "multi",
-          "sort": ""
-        }
-      },
-      "fieldConfig": {
-        "defaults": {
-          "unit": "short",
-          "custom": {
-            "drawStyle": "line",
-            "lineInterpolation": "stepAfter",
-            "fillOpacity": 10,
-            "showPoints": "never"
-          }
-        },
-        "overrides": [
-          {
-            "matcher": {
-              "id": "byName",
-              "options": "Allocatable (total)"
-            },
-            "properties": [
-              {
-                "id": "color",
-                "value": {
-                  "fixedColor": "blue",
-                  "mode": "fixed"
-                }
-              }
-            ]
-          }
-        ]
-      }
-    },
-    {
-      "type": "row",
-      "collapsed": false,
-      "title": "Pods with GPU",
-      "gridPos": {
-        "h": 1,
-        "w": 24,
-        "x": 0,
-        "y": 14
-      },
-      "id": 20,
-      "panels": []
-    },
-    {
-      "type": "table",
-      "id": 21,
-      "targets": [
-        {
-          "expr": "kube_pod_container_resource_requests{resource=\"nvidia_com_gpu\", namespace=~\"$namespace\"} * on(namespace, pod) group_left(phase) (kube_pod_status_phase{phase=~\"Running|Pending\"} == 1)",
-          "instant": true,
-          "range": false,
-          "format": "table",
-          "refId": "requested"
-        },
-        {
-          "expr": "kube_pod_container_resource_limits{resource=\"nvidia_com_gpu\", namespace=~\"$namespace\"} * on(namespace, pod) group_left() (kube_pod_status_phase{phase=~\"Running|Pending\"} == 1)",
-          "instant": true,
-          "range": false,
-          "format": "table",
-          "refId": "limits"
-        }
-      ],
-      "title": "Pods requesting GPU",
-      "description": "Per-pod GPU requests and limits with scheduling status — Running or Pending.",
-      "transparent": false,
-      "datasource": {
-        "type": "prometheus",
-        "uid": "$ds_prometheus"
-      },
-      "gridPos": {
-        "h": 10,
-        "w": 24,
-        "x": 0,
-        "y": 15
-      },
-      "repeatDirection": "h",
-      "transformations": [
-        {
-          "id": "joinByField",
-          "options": {
-            "byField": "pod",
-            "mode": "outer"
-          }
-        },
-        {
-          "id": "organize",
-          "options": {
-            "excludeByName": {
-              "Time": true,
-              "Time 1": true,
-              "Time 2": true,
-              "__name__": true,
-              "__name__ 1": true,
-              "__name__ 2": true,
-              "cluster": true,
-              "cluster 1": true,
-              "cluster 2": true,
-              "container 2": true,
-              "endpoint": true,
-              "endpoint 1": true,
-              "endpoint 2": true,
-              "instance": true,
-              "instance 1": true,
-              "instance 2": true,
-              "job": true,
-              "job 1": true,
-              "job 2": true,
-              "namespace 2": true,
-              "node 2": true,
-              "prometheus": true,
-              "prometheus 1": true,
-              "prometheus 2": true,
-              "resource": true,
-              "resource 1": true,
-              "resource 2": true,
-              "service": true,
-              "service 1": true,
-              "service 2": true,
-              "tenant": true,
-              "tenant 1": true,
-              "tenant 2": true,
-              "tier": true,
-              "tier 1": true,
-              "tier 2": true,
-              "uid": true,
-              "uid 1": true,
-              "uid 2": true,
-              "unit": true,
-              "unit 1": true,
-              "unit 2": true
-            },
-            "indexByName": {
-              "Value #limits": 5,
-              "Value #requested": 4,
-              "container 1": 2,
-              "namespace 1": 0,
-              "node 1": 3,
-              "phase": 6,
-              "pod": 1
-            },
-            "renameByName": {
-              "Value #limits": "Limit",
-              "Value #requested": "Req",
-              "container 1": "Container",
-              "namespace 1": "Namespace",
-              "node 1": "Node",
-              "phase": "Status"
-            }
-          }
-        }
-      ],
-      "options": {
-        "frameIndex": 0,
-        "showHeader": true,
-        "showTypeIcons": false,
-        "footer": {
-          "show": false,
-          "reducer": []
-        },
-        "cellHeight": "sm"
-      },
-      "fieldConfig": {
-        "defaults": {},
-        "overrides": [
-          {
-            "matcher": {
-              "id": "byName",
-              "options": "Status"
-            },
-            "properties": [
-              {
-                "id": "custom.cellOptions",
-                "value": {
-                  "mode": "basic",
-                  "type": "color-background"
-                }
-              },
-              {
-                "id": "mappings",
-                "value": [
-                  {
-                    "options": {
-                      "Failed": {
-                        "color": "red",
-                        "index": 2
-                      },
-                      "Pending": {
-                        "color": "orange",
-                        "index": 1
-                      },
-                      "Running": {
-                        "color": "green",
-                        "index": 0
-                      }
-                    },
-                    "type": "value"
-                  }
-                ]
-              }
-            ]
-          }
-        ]
-      }
-    }
-  ],
-  "templating": {
-    "list": [
-      {
-        "type": "datasource",
-        "name": "ds_prometheus",
-        "label": "Prometheus",
-        "skipUrlSync": false,
-        "query": "prometheus",
-        "current": {
-          "selected": false,
-          "text": "default",
-          "value": "default"
-        },
-        "multi": false,
-        "allowCustomValue": true,
-        "includeAll": false,
-        "regex": "",
-        "auto": false,
-        "auto_min": "10s",
-        "auto_count": 30
-      },
-      {
-        "type": "query",
-        "name": "namespace",
-        "label": "Namespace",
-        "skipUrlSync": false,
-        "query": "label_values(kube_pod_container_resource_requests{resource=\"nvidia_com_gpu\"}, namespace)",
-        "datasource": {
-          "type": "prometheus",
-          "uid": "$ds_prometheus"
-        },
-        "current": {
-          "selected": true,
-          "text": "All",
-          "value": "$__all"
-        },
-        "multi": true,
-        "allowCustomValue": true,
-        "refresh": 2,
-        "sort": 1,
-        "includeAll": true,
-        "auto": false,
-        "auto_min": "10s",
-        "auto_count": 30
-      }
-    ]
-  },
-  "annotations": {}
-}

docs/agents/changelog.md

@@ -6,20 +6,6 @@ This file contains detailed instructions for AI-powered IDE on how to generate c
 
 Follow these instructions when the user explicitly asks to generate a changelog.
 
-## Scope and boundaries
-
-**Your single deliverable is the file `docs/changelogs/v<version>.md`.** Write the complete, verified changelog to that path. That is the entire task. Exit as soon as the file is written and verified against the checklist in Step 9.
-
-Unless the caller explicitly instructs otherwise:
-
-- **In the cozystack working tree**, do not run `git commit`, `git push`, `git checkout` (to switch branches), `git branch`, `git tag`, `git reset`, `git merge`, or `git rebase`. Do not write to local branches, tags, or HEAD. `git fetch` is expected and fine (see the read-only analysis list below).
-- **Do not** push to any remote, open pull requests, or issue GitHub API write calls (POST / PATCH / DELETE) for any repository.
-- In the cozystack working tree, the **only** file you create or modify is `docs/changelogs/v<version>.md`. Cloning auxiliary repositories under `_repos/` for cross-repo analysis (see Step 6) is fine; local git operations inside those disposable clones (`git checkout`, `git pull`, etc.) are allowed — just never push from them or open PRs against them.
-
-The caller — a GitHub Actions workflow in CI, or a developer running you interactively — owns branching, committing, pushing, and PR creation. They will perform those actions after you exit. Do not pre-empt them even if the working tree looks ready.
-
-Read-only analysis is expected and encouraged: `git log`, `git show`, `git fetch`, `git diff`, `gh pr view`, `gh api` GET requests, and reading any file in the repository.
-
 ## Required Tools
 
 Before generating changelogs, ensure you have access to `gh` (GitHub CLI) tool, which is used to fetch commit and PR author information. The GitHub CLI is used to correctly identify PR authors from commits and pull requests.
@@ -36,7 +22,7 @@ When the user asks to generate a changelog, follow these steps in the specified
 - [ ] Step 5: Get the list of commits for the release period
 - [ ] Step 6: Check additional repositories (website is REQUIRED, optional repos if tags exist)
   - [ ] **MANDATORY**: Check website repository for documentation changes WITH authors and PR links via GitHub CLI
-  - [ ] **MANDATORY**: Check ALL optional repositories (talm, boot-to-talos, cozyhr, cozy-proxy, external-apps-example, ansible-cozystack) for tags during release period
+  - [ ] **MANDATORY**: Check ALL optional repositories (talm, boot-to-talos, cozyhr, cozy-proxy) for tags during release period
   - [ ] **MANDATORY**: For ALL commits from additional repos, get GitHub username via CLI, prioritizing PR author over commit author.
 - [ ] Step 7: Analyze commits (extract PR numbers, authors, user impact)
   - [ ] **MANDATORY**: For EVERY PR in main repo, get PR author via `gh pr view <PR_NUMBER> --json author --jq .author.login` (do NOT skip this step)
@@ -162,8 +148,6 @@ Cozystack release may include changes from related repositories. Check and inclu
 - [https://github.com/cozystack/boot-to-talos](https://github.com/cozystack/boot-to-talos)
 - [https://github.com/cozystack/cozyhr](https://github.com/cozystack/cozyhr)
 - [https://github.com/cozystack/cozy-proxy](https://github.com/cozystack/cozy-proxy)
-- [https://github.com/cozystack/external-apps-example](https://github.com/cozystack/external-apps-example)
-- [https://github.com/cozystack/ansible-cozystack](https://github.com/cozystack/ansible-cozystack)
 
 **⚠️ IMPORTANT**: You MUST check ALL optional repositories for tags created during the release period. Do NOT skip this step even if you think there might not be any tags. Use the process below to verify.
 
@@ -211,7 +195,7 @@ Cozystack release may include changes from related repositories. Check and inclu
 
 3. **For optional repositories, check if tags exist during release period:**
 
-   **⚠️ MANDATORY: You MUST check ALL optional repositories (talm, boot-to-talos, cozyhr, cozy-proxy, external-apps-example, ansible-cozystack). Do NOT skip any repository!**
+   **⚠️ MANDATORY: You MUST check ALL optional repositories (talm, boot-to-talos, cozyhr, cozy-proxy). Do NOT skip any repository!**
 
    **Use the helper script:**
    ```bash
@@ -224,7 +208,7 @@ Cozystack release may include changes from related repositories. Check and inclu
    ```
    
    The script will:
-   - Check ALL optional repositories (talm, boot-to-talos, cozyhr, cozy-proxy, external-apps-example, ansible-cozystack)
+   - Check ALL optional repositories (talm, boot-to-talos, cozyhr, cozy-proxy)
    - Look for tags created during the release period
    - Get commits between tags (if tags exist) or by date range (if no tags)
    - Extract PR numbers from commit messages
@@ -585,7 +569,7 @@ Create a new changelog file in the format matching previous versions:
 - [ ] Step 5 completed: **ALL commits included** (including merge commits and backports) - do not skip any commits
 - [ ] Step 5 completed: **Backports identified and handled correctly** - original PR author used, both original and backport PR numbers included
 - [ ] Step 6 completed: Website repository checked for documentation changes WITH authors and PR links via GitHub CLI
-- [ ] Step 6 completed: **ALL** optional repositories (talm, boot-to-talos, cozyhr, cozy-proxy, external-apps-example, ansible-cozystack) checked for tags during release period
+- [ ] Step 6 completed: **ALL** optional repositories (talm, boot-to-talos, cozyhr, cozy-proxy) checked for tags during release period
 - [ ] Step 6 completed: For ALL commits from additional repos, GitHub username obtained via GitHub CLI (not skipped). For commits with PR numbers, PR author used via `gh pr view` (not commit author)
 - [ ] Step 7 completed: For EVERY PR in main repo (including backports), PR author obtained via `gh pr view <PR_NUMBER> --json author --jq .author.login` (not skipped or assumed). Commit author NOT used - always use PR author
 - [ ] Step 7 completed: **Backports verified** - for each backport PR, original PR found and original PR author used in changelog
@@ -622,8 +606,6 @@ Create a new changelog file in the format matching previous versions:
 **Save the changelog:**
 Save the changelog to file `docs/changelogs/v<version>.md` according to the version for which the changelog is being generated.
 
-**Then exit.** Do not commit, push, create a branch, or open a pull request — the caller handles all git and GitHub operations after you return. See the "Scope and boundaries" section at the top of this document.
-
 ### Important notes
 
 - **After fetch with --force** local tags are up-to-date, use them for work
@@ -646,7 +628,7 @@ Save the changelog to file `docs/changelogs/v<version>.md` according to the vers
 
 - **Additional repositories (Step 6) - MANDATORY**: 
   - **⚠️ CRITICAL**: Always check the **website** repository for documentation changes during the release period. This is a required step and MUST NOT be skipped.
-  - **⚠️ CRITICAL**: You MUST check ALL optional repositories (talm, boot-to-talos, cozyhr, cozy-proxy, external-apps-example, ansible-cozystack) for tags during the release period. Do NOT skip any repository even if you think there might not be tags.
+  - **⚠️ CRITICAL**: You MUST check ALL optional repositories (talm, boot-to-talos, cozyhr, cozy-proxy) for tags during the release period. Do NOT skip any repository even if you think there might not be tags.
   - **CRITICAL**: For ALL entries from additional repositories (website and optional), you MUST:
     - **MANDATORY**: Extract PR number from commit message first
     - **MANDATORY**: For commits with PR numbers, ALWAYS use `gh pr view <PR_NUMBER> --repo cozystack/<repo> --json author --jq .author.login` to get PR author (not commit author)
@@ -655,7 +637,7 @@ Save the changelog to file `docs/changelogs/v<version>.md` according to the vers
     - **MANDATORY**: Do NOT use commit author for PRs - always use PR author
     - Include PR link or commit hash reference
     - Format: `* **[repo] Description**: details ([**@username**](https://github.com/username) in cozystack/repo#123)`
-  - For **optional repositories** (talm, boot-to-talos, cozyhr, cozy-proxy, external-apps-example, ansible-cozystack), you MUST check ALL of them for tags during the release period. Use the loop provided in Step 6 to check each repository systematically.
+  - For **optional repositories** (talm, boot-to-talos, cozyhr, cozy-proxy), you MUST check ALL of them for tags during the release period. Use the loop provided in Step 6 to check each repository systematically.
   - When including changes from additional repositories, use the format: `[repo-name] Description` and link to the repository's PR/issue if available
   - **Prefer PR numbers over commit hashes**: For commits from additional repositories, extract PR number from commit message using GitHub API. Use PR format (`cozystack/website#123`) instead of commit hash (`cozystack/website@abc1234`) when available
   - **Never add entries without author and PR/commit reference**: Every entry from additional repositories must have both author and link

docs/agents/contributing.md

@@ -1,140 +1,167 @@
-# Contributing Conventions for AI Agents
+# Instructions for AI Agents
 
-Project-side conventions for commits, branches, and pull requests in Cozystack.
+Guidelines for AI agents contributing to Cozystack.
 
 ## Checklist for Creating a Pull Request
 
-- [ ] Commit message follows Conventional Commits format
+- [ ] Changes are made and tested
+- [ ] Commit message uses correct `[component]` prefix
 - [ ] Commit is signed off with `--signoff`
 - [ ] Branch is rebased on `upstream/main` (no extra commits)
 - [ ] PR body includes description and release note
-- [ ] Ran `make generate` in every package whose `values.yaml`, `values.schema.json`, `Chart.yaml`, or `README.md` was touched, and committed the regenerated files
+- [ ] PR is pushed and created with `gh pr create`
 
-## Regenerate Artifacts Before Committing
+## How to Commit and Create Pull Requests
 
-Several files in each package are produced by `make generate` from `values.yaml` + `values.schema.json` and must stay in sync with the hand-edited sources:
+### 1. Make Your Changes
 
-- `packages/(apps|extra)/<name>/README.md` — regenerated by `cozyvalues-gen` (parameter table, formatting).
-- `packages/(apps|extra)/<name>/values.schema.json` — `cozyvalues-gen` rewrites ordering and derived fields.
-- `packages/system/<name>-rd/cozyrds/<name>.yaml` — produced by `hack/update-crd.sh`, which `make generate` invokes.
+Edit the necessary files in the codebase.
 
-**Before committing edits to any of those sources**, run `make generate` inside the package and stage the full diff:
+### 2. Commit with Proper Format
+
+Use the `[component]` prefix and `--signoff` flag:
 
 ```bash
-make -C packages/<apps-or-extra>/<name> generate
-git add packages/<apps-or-extra>/<name>/ packages/system/<name>-rd/
+git commit --signoff -m "[component] Brief description of changes"
 ```
 
-The repo's pre-commit CI job runs `make generate` in every package and then `git diff --exit-code`. Any unstaged generator output fails the job with exit code 123 and blocks the PR. Also rerun `make generate` after a `git commit --amend` if the amended change touched any of the sources above.
-
-To locate packages a WIP branch likely needs to be regenerated:
-
-```bash
-git diff --name-only | xargs -n1 dirname | sort -u | grep ^packages/
-```
-
-## Commit Format
-
-Follow [Conventional Commits](https://www.conventionalcommits.org/) with `--signoff`:
-
-```bash
-git commit --signoff -m "type(scope): brief description"
-```
-
-**Types:** `feat`, `fix`, `docs`, `style`, `refactor`, `perf`, `test`, `build`, `ci`, `chore`
-
-**Scopes** (examples — not an exhaustive list; pick the most specific scope that describes the change, and introduce a new one if a genuinely new area needs its own):
-
-- System, e.g.: `dashboard`, `platform`, `operator`, `cilium`, `kube-ovn`, `linstor`, `fluxcd`, `cluster-api`
-- Apps, e.g.: `postgres`, `mariadb`, `redis`, `kafka`, `clickhouse`, `virtual-machine`, `kubernetes`
-- Other, e.g.: `api`, `hack`, `tests`, `ci`, `docs`, `agents`, `maintenance`
-
-Breaking changes: append `!` after type/scope (`feat(api)!: ...`) or add a `BREAKING CHANGE:` footer.
+**Component prefixes:**
+- System: `[dashboard]`, `[platform]`, `[cilium]`, `[kube-ovn]`, `[linstor]`, `[fluxcd]`, `[cluster-api]`
+- Apps: `[postgres]`, `[mariadb]`, `[redis]`, `[kafka]`, `[clickhouse]`, `[virtual-machine]`, `[kubernetes]`
+- Other: `[tests]`, `[ci]`, `[docs]`, `[maintenance]`
 
 **Examples:**
 ```bash
-git commit --signoff -m "feat(dashboard): add config hash annotations to restart pods on config changes"
-git commit --signoff -m "fix(postgres): update operator to version 1.2.3"
-git commit --signoff -m "docs(contributing): add installation guide"
+git commit --signoff -m "[dashboard] Add config hash annotations to restart pods on config changes"
+git commit --signoff -m "[postgres] Update operator to version 1.2.3"
+git commit --signoff -m "[docs] Add installation guide"
 ```
 
-## PR Title Auto-Labeling
+### 3. Rebase on upstream/main (if needed)
 
-`.github/workflows/pr-labeler.yaml` parses the PR title on `opened`, `edited`, `reopened`, and `synchronize` events and applies labels additively (never removes). The title is expected to follow Conventional Commits — same format as commit messages above.
-
-**Type → `kind/*`:**
-
-| type      | label              |
-| --------- | ------------------ |
-| feat      | kind/feature       |
-| fix       | kind/bug           |
-| docs      | kind/documentation |
-| chore     | kind/cleanup       |
-| refactor  | kind/cleanup       |
-| style, perf, test, build, ci, revert | (no kind label) |
-
-**Scope → `area/*`** (full mapping in `.github/workflows/pr-labeler.yaml`):
-
-| scope (examples) | label |
-| --- | --- |
-| agents, ai | area/ai |
-| api, cozystack-api | area/api |
-| build | area/build |
-| ci | area/ci |
-| dashboard | area/dashboard |
-| postgres, mariadb, redis, etcd, kafka, clickhouse, postgres-operator, mariadb-operator | area/database |
-| extra | area/extra |
-| kubernetes | area/kubernetes |
-| monitoring, vlogs, vmstack, grafana, workloadmonitor | area/monitoring |
-| ingress, gateway, vpn, metallb, cilium, kube-ovn, cozy-proxy, ... | area/networking |
-| platform, bundle, flux, fluxcd, cluster-api, talos, installer, cozyctl, cozystack-engine, cozy-lib | area/platform |
-| backport, release | area/release |
-| seaweedfs, bucket, linstor, velero, harbor, backups | area/storage |
-| tests, e2e | area/testing |
-| kubevirt, cdi, vmi, vm-import, virtual-machine, hami, gpu-operator | area/virtualization |
-
-**Special handling:**
-
-- `[Backport release-1.x]` prefix is stripped before parsing; `area/release` and `backport` labels are added.
-- Composite scope (`feat(platform, system, apps): ...`) — each comma-separated part is mapped independently.
-- `!` after type or `BREAKING CHANGE:` footer in the body → `kind/breaking-change`.
-- Unmapped scope or non-conventional title → `area/uncategorized` (signals the PR needs manual area selection).
-- Bracket-style fallback (`[scope] description`) maps `scope` → `area/*` but cannot infer `kind/*`.
-
-### AI Agent Attribution
-
-When an AI agent authors or materially assists with a commit, add an `Assisted-By:` trailer naming the model:
-
-```text
-Assisted-By: Claude <noreply@anthropic.com>
-Assisted-By: GPT-5 <noreply@openai.com>
-Assisted-By: Gemini <noreply@google.com>
-```
-
-This sits alongside the `Signed-off-by:` trailer produced by `--signoff`. Use one trailer per model if multiple contributed.
-
-## Rebasing on upstream/main
-
-If the branch has extra commits, clean it up:
+If your branch has extra commits, clean it up:
 
 ```bash
+# Fetch latest
 git fetch upstream
+
+# Create clean branch from upstream/main
 git checkout -b my-feature upstream/main
+
+# Cherry-pick only your commit
 git cherry-pick <your-commit-hash>
-git push -f origin my-feature
+
+# Force push to your branch
+git push -f origin my-feature:my-branch-name
 ```
 
-## Pull Request Body
+### 4. Push Your Branch
 
-Fill in the template at [`.github/PULL_REQUEST_TEMPLATE.md`](../../.github/PULL_REQUEST_TEMPLATE.md). It includes the required `release-note` block.
+```bash
+git push origin <branch-name>
+```
 
-Create the PR with `gh pr create --title "type(scope): brief description" --body-file <file>`.
+### 5. Create Pull Request
 
-## Fetching Unresolved Review Comments
+Write the PR body to a temporary file:
 
-Cozystack uses GitHub review threads with resolution status. Only unresolved threads are actionable — resolved threads are already handled.
+```bash
+cat > /tmp/pr_body.md << 'EOF'
+## What this PR does
 
-The REST endpoint `/pulls/{pr}/reviews` returns review summaries, not individual review comments. Use the GraphQL API to access `reviewThreads` with `isResolved` status:
+Brief description of the changes.
+
+Changes:
+- Change 1
+- Change 2
+
+### Release note
+
+```release-note
+[component] Description for changelog
+```
+EOF
+```
+
+Create the PR:
+
+```bash
+gh pr create --title "[component] Brief description" --body-file /tmp/pr_body.md
+```
+
+Clean up:
+
+```bash
+rm /tmp/pr_body.md
+```
+
+## Addressing AI Bot Reviewer Comments
+
+When the user asks to fix comments from AI bot reviewers (like Qodo, Copilot, etc.):
+
+### 1. Get PR Comments
+
+View all comments on the pull request:
+
+```bash
+gh pr view <PR-number> --comments
+```
+
+Or for the current branch:
+
+```bash
+gh pr view --comments
+```
+
+### 2. Review Each Comment Carefully
+
+**Important**: Do NOT blindly apply all suggestions. Each comment should be evaluated:
+
+- **Consider context** - Does the suggestion make sense for this specific case?
+- **Check project conventions** - Does it align with Cozystack patterns?
+- **Evaluate impact** - Will this improve code quality or introduce issues?
+- **Question validity** - AI bots can be wrong or miss context
+
+**When to apply:**
+- ✅ Legitimate bugs or security issues
+- ✅ Clear improvements to code quality
+- ✅ Better error handling or edge cases
+- ✅ Conformance to project conventions
+
+**When to skip:**
+- ❌ Stylistic preferences that don't match project style
+- ❌ Over-engineering simple code
+- ❌ Changes that break existing patterns
+- ❌ Suggestions that show misunderstanding of the code
+
+### 3. Apply Valid Fixes
+
+Make changes addressing the valid comments. Use your judgment.
+
+### 4. Leave Changes Uncommitted
+
+**Critical**: Do NOT commit or push the changes automatically.
+
+Leave the changes in the working directory so the user can:
+- Review the fixes
+- Decide whether to commit them
+- Make additional adjustments if needed
+
+```bash
+# After making changes, show status but DON'T commit
+git status
+git diff
+```
+
+The user will commit and push when ready.
+
+## Code Review Comments
+
+When asked to fix code review comments, **always work only with unresolved (open) comments**. Resolved comments should be ignored as they have already been addressed.
+
+### Getting Unresolved Review Comments
+
+Use GitHub GraphQL API to fetch only unresolved review comments from a pull request:
 
 ```bash
 gh api graphql -F owner=cozystack -F repo=cozystack -F pr=<PR_NUMBER> -f query='
@@ -162,7 +189,27 @@ query($owner: String!, $repo: String!, $pr: Int!) {
 }' --jq '.data.repository.pullRequest.reviewThreads.nodes[] | select(.isResolved == false) | .comments.nodes[]'
 ```
 
-Compact one-line variant:
+### Filtering for Unresolved Comments
+
+The key filter is `select(.isResolved == false)` which ensures only unresolved review threads are processed. Each thread can contain multiple comments, but if the thread is resolved, all its comments should be ignored.
+
+### Working with Review Comments
+
+1. **Fetch unresolved comments** using the GraphQL query above
+2. **Parse the results** to identify:
+   - File path (`path`)
+   - Line number (`line` or `originalLine`)
+   - Comment text (`bodyText`)
+   - Author (`author.login`)
+3. **Address each unresolved comment** by:
+   - Locating the relevant code section
+   - Making the requested changes
+   - Ensuring the fix addresses the concern raised
+4. **Do NOT process resolved comments** - they have already been handled
+
+### Example: Compact List of Unresolved Comments
+
+For a quick overview of unresolved comments:
 
 ```bash
 gh api graphql -F owner=cozystack -F repo=cozystack -F pr=<PR_NUMBER> -f query='
@@ -186,3 +233,43 @@ query($owner: String!, $repo: String!, $pr: Int!) {
   }
 }' --jq '.data.repository.pullRequest.reviewThreads.nodes[] | select(.isResolved == false) | .comments.nodes[] | "\(.path):\(.line // "N/A") - \(.author.login): \(.bodyText[:150])"'
 ```
+
+### Important Notes
+
+- **REST API limitation**: The REST endpoint `/pulls/{pr}/reviews` returns review summaries, not individual review comments. Use GraphQL API for accessing `reviewThreads` with `isResolved` status.
+- **Thread-based resolution**: Comments are organized in threads. If a thread is resolved (`isResolved: true`), ignore all comments in that thread.
+- **Always filter**: Never process comments from resolved threads, even if they appear in the results.
+
+### Example Workflow
+
+```bash
+# Get PR comments
+gh pr view 1234 --comments
+
+# Review comments and identify valid ones
+# Make necessary changes to address valid comments
+# ... edit files ...
+
+# Show what was changed (but don't commit)
+git status
+git diff
+
+# Tell the user what was fixed and what was skipped
+```
+
+## Git Permissions
+
+Request these permissions when needed:
+- `git_write` - For commit, rebase, cherry-pick, branch operations
+- `network` - For push, fetch, pull operations
+
+## Common Issues
+
+**PR has extra commits?**  
+→ Rebase on `upstream/main` and cherry-pick only your commits
+
+**Wrong commit message?**  
+→ `git commit --amend --signoff -m "[correct] message"` then `git push -f`
+
+**Need to update PR?**  
+→ `gh pr edit <number> --body "new description"`

docs/agents/overview.md

@@ -78,18 +78,11 @@ packages/<category>/<package-name>/
 - Add proper error handling and structured logging
 
 ### Git Commits
-- Follow [Conventional Commits](https://www.conventionalcommits.org/) format: `type(scope): description`
+- Use format: `[component] Description`
 - Always use `--signoff` flag
 - Reference PR numbers when available
 - Keep commits atomic and focused
-
-### PackageSource CRD upgrade policy
-
-Each component in a `PackageSource` may set `install.upgradeCRDs` to control how CRDs from the chart's `crds/` directory are handled on `HelmRelease` upgrades. Allowed values: `Skip` (default — helm-controller does not touch CRDs on upgrade), `Create` (create new CRDs only), `CreateReplace` (create new and overwrite existing).
-
-Set `upgradeCRDs: CreateReplace` for operators whose upstream regularly adds new CRDs between versions (etcd-operator, cnpg, kubevirt, kamaji). Without it, new CRDs from a chart bump do not land on existing clusters — only fresh installs get them.
-
-Do **not** set `CreateReplace` blindly: it overwrites every CRD in `crds/` and can cause silent data loss if upstream drops a field from a CRD that has live objects. Only enable it for operators whose schema evolution is additive-only. When in doubt, leave it unset and apply new CRDs manually.
+- Follow conventional commit format for changelogs
 
 ### Documentation
 

docs/changelogs/v0.40.5.md

@@ -1,15 +0,0 @@
-<!--
-https://github.com/cozystack/cozystack/releases/tag/v0.40.5
--->
-
-## Improvements
-
-* **[dashboard] Improve dashboard session params**: Improved session parameter handling in the dashboard for better user experience and more reliable session management ([**@lllamnyp**](https://github.com/lllamnyp) in #1913, #1919).
-
-## Dependencies
-
-* **Update cozyhr to v1.6.1**: Updated cozyhr to v1.6.1, which fixes a critical bug causing helm-controller v0.37.0+ to unexpectedly uninstall HelmReleases after cozyhr apply by correcting history snapshot fields for helm-controller compatibility ([**@kvaps**](https://github.com/kvaps) in cozystack/cozyhr#10).
-
----
-
-**Full Changelog**: [v0.40.4...v0.40.5](https://github.com/cozystack/cozystack/compare/v0.40.4...v0.40.5)

docs/changelogs/v0.40.6.md

@@ -1,11 +0,0 @@
-<!--
-https://github.com/cozystack/cozystack/releases/tag/v0.40.6
--->
-
-## Fixes
-
-* **[kubernetes] Fix manifests for kubernetes deployment**: Fixed incorrect manifests that prevented proper Kubernetes deployment, restoring correct application behavior ([**@IvanHunters**](https://github.com/IvanHunters) in #1943, #1944).
-
----
-
-**Full Changelog**: [v0.40.5...v0.40.6](https://github.com/cozystack/cozystack/compare/v0.40.5...v0.40.6)

docs/changelogs/v0.40.7.md

@@ -1,11 +0,0 @@
-<!--
-https://github.com/cozystack/cozystack/releases/tag/v0.40.7
--->
-
-## Security
-
-* **[dashboard] Verify JWT token**: Added JWT token verification to the dashboard, ensuring that authentication tokens are properly validated before granting access. This prevents unauthorized access through forged or expired tokens ([**@lllamnyp**](https://github.com/lllamnyp) in #1980, #1984).
-
----
-
-**Full Changelog**: [v0.40.6...v0.40.7](https://github.com/cozystack/cozystack/compare/v0.40.6...v0.40.7)

docs/changelogs/v0.41.4.md

@@ -1,11 +0,0 @@
-<!--
-https://github.com/cozystack/cozystack/releases/tag/v0.41.4
--->
-
-## Dependencies
-
-* **Update cozyhr to v1.6.1**: Updated cozyhr to v1.6.1, which fixes a critical bug causing helm-controller v0.37.0+ to unexpectedly uninstall HelmReleases after cozyhr apply by correcting history snapshot fields for helm-controller compatibility ([**@kvaps**](https://github.com/kvaps) in cozystack/cozyhr#10).
-
----
-
-**Full Changelog**: [v0.41.3...v0.41.4](https://github.com/cozystack/cozystack/compare/v0.41.3...v0.41.4)

docs/changelogs/v0.41.5.md

@@ -1,21 +0,0 @@
-<!--
-https://github.com/cozystack/cozystack/releases/tag/v0.41.5
--->
-
-## Features and Improvements
-
-* **[dashboard] Add "Edit" button to all resources**: Added an "Edit" button across all resource views in the dashboard, allowing users to modify resource configurations directly from the UI ([**@sircthulhu**](https://github.com/sircthulhu) in #1928, #1931).
-
-* **[dashboard] Add resource quota usage to tenant details page**: Added resource quota usage display to the tenant details page, giving administrators visibility into how much of allocated resources each tenant is consuming ([**@sircthulhu**](https://github.com/sircthulhu) in #1929, #1932).
-
-* **[branding] Separate values for keycloak**: Separated Keycloak branding values into dedicated configuration, allowing more granular customization of Keycloak appearance without affecting other branding settings ([**@nbykov0**](https://github.com/nbykov0) in #1946).
-
-* **Add instance profile label to workload monitor**: Added instance profile metadata labels to the workload monitor, enabling better resource tracking and monitoring by instance profile type ([**@matthieu-robin**](https://github.com/matthieu-robin) in #1954, #1957).
-
-## Fixes
-
-* **[kubernetes] Fix manifests for kubernetes deployment**: Fixed incorrect manifests that prevented proper Kubernetes deployment, restoring correct application behavior ([**@IvanHunters**](https://github.com/IvanHunters) in #1943, #1945).
-
----
-
-**Full Changelog**: [v0.41.4...v0.41.5](https://github.com/cozystack/cozystack/compare/v0.41.4...v0.41.5)

docs/changelogs/v0.41.6.md

@@ -1,17 +0,0 @@
-<!--
-https://github.com/cozystack/cozystack/releases/tag/v0.41.6
--->
-
-## Improvements
-
-* **[vm] Allow changing field external after creation**: Users can now modify the external network field on virtual machines after initial creation, providing more flexibility in VM networking configuration without requiring recreation ([**@sircthulhu**](https://github.com/sircthulhu) in #1956, #1962).
-
-* **[branding] Separate values for keycloak**: Separated Keycloak branding values into dedicated configuration for more granular customization of Keycloak appearance ([**@nbykov0**](https://github.com/nbykov0) in #1947, #1963).
-
-## Fixes
-
-* **[kubernetes] Fix coredns serviceaccount to match kubernetes bootstrap RBAC**: Configured the CoreDNS chart to create a `kube-dns` ServiceAccount matching the Kubernetes bootstrap ClusterRoleBinding, fixing RBAC errors (`Failed to watch`) when CoreDNS pods restart ([**@mattia-eleuteri**](https://github.com/mattia-eleuteri) in #1958, #1978).
-
----
-
-**Full Changelog**: [v0.41.5...v0.41.6](https://github.com/cozystack/cozystack/compare/v0.41.5...v0.41.6)

docs/changelogs/v0.41.7.md

@@ -1,15 +0,0 @@
-<!--
-https://github.com/cozystack/cozystack/releases/tag/v0.41.7
--->
-
-## Security
-
-* **[dashboard] Verify JWT token**: Added JWT token verification to the dashboard, ensuring that authentication tokens are properly validated before granting access. This prevents unauthorized access through forged or expired tokens ([**@lllamnyp**](https://github.com/lllamnyp) in #1980, #1983).
-
-## Fixes
-
-* **[postgres-operator] Correct PromQL syntax in CNPGClusterOffline alert**: Fixed incorrect PromQL syntax in the `CNPGClusterOffline` alert rule for CloudNativePG, ensuring the alert fires correctly when all instances of a PostgreSQL cluster are offline ([**@mattia-eleuteri**](https://github.com/mattia-eleuteri) in #1981, #1989).
-
----
-
-**Full Changelog**: [v0.41.6...v0.41.7](https://github.com/cozystack/cozystack/compare/v0.41.6...v0.41.7)

docs/changelogs/v0.41.8.md

@@ -1,17 +0,0 @@
-<!--
-https://github.com/cozystack/cozystack/releases/tag/v0.41.8
--->
-
-## Features and Improvements
-
-* **[kubernetes] Auto-enable Gateway API support in cert-manager**: cert-manager now automatically enables `enableGatewayAPI` when the Gateway API addon is active in the Kubernetes application. Users no longer need to manually configure this setting, and the option can still be overridden via `valuesOverride` ([**@kvaps**](https://github.com/kvaps) in #1997, #2012).
-
-* **[vm] Allow switching between instancetype and custom resources**: Users can now switch virtual machines between instancetype-based and custom resource configurations after creation. The upgrade hook atomically patches VM resources, providing more flexibility in adjusting VM sizing without recreation ([**@sircthulhu**](https://github.com/sircthulhu) in #2008, #2013).
-
-## Fixes
-
-* **[dashboard] Add startupProbe to prevent container restarts on slow hardware**: Added `startupProbe` to both `bff` and `web` containers in the dashboard deployment. On slow hardware, kubelet was killing containers because the `livenessProbe` only allowed ~33 seconds for startup. The `startupProbe` gives containers up to 60 seconds to start before `livenessProbe` kicks in ([**@kvaps**](https://github.com/kvaps) in #1996, #2014).
-
----
-
-**Full Changelog**: [v0.41.7...v0.41.8](https://github.com/cozystack/cozystack/compare/v0.41.7...v0.41.8)

docs/changelogs/v0.41.9.md

@@ -1,15 +0,0 @@
-<!--
-https://github.com/cozystack/cozystack/releases/tag/v0.41.9
--->
-
-## Fixes
-
-* **[cozystack-basics] Deny resourcequotas deletion for tenant admin**: Prevented tenant administrators from deleting resource quotas, ensuring that resource limits set by platform administrators cannot be bypassed by tenant-level users ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in #2076).
-
-## Dependencies
-
-* **Update Kube-OVN to v1.15.3**: Updated Kube-OVN CNI to v1.15.3 with latest bug fixes and improvements ([**@kvaps**](https://github.com/kvaps)).
-
----
-
-**Full Changelog**: [v0.41.8...v0.41.9](https://github.com/cozystack/cozystack/compare/v0.41.8...v0.41.9)

docs/changelogs/v1.0.0-rc.1.md

@@ -1,65 +0,0 @@
-<!--
-https://github.com/cozystack/cozystack/releases/tag/v1.0.0-rc.1
--->
-
-> **⚠️ Release Candidate Warning**: This is a release candidate intended for final validation before the stable v1.0.0 release. Breaking changes are not expected at this stage, but please test thoroughly before deploying to production.
-
-## Features and Improvements
-
-* **[harbor] Add managed Harbor container registry**: Added Harbor v2.14.2 as a managed tenant-level container registry service. The application uses CloudNativePG for PostgreSQL, the Redis operator for caching, and S3 via COSI BucketClaim (from SeaweedFS) for registry image storage. Auto-generated admin credentials are persisted across upgrades, TLS is handled by cert-manager, and Trivy vulnerability scanner is included. Users can now deploy a fully managed, production-ready OCI container registry within their tenant ([**@lexfrei**](https://github.com/lexfrei) in #2058).
-
-* **[kubernetes] Update supported Kubernetes versions to v1.30–v1.35**: Updated the tenant Kubernetes version matrix to v1.30, v1.31, v1.32, v1.33, v1.34, and v1.35 (now the default). EOL versions v1.28 and v1.29 are removed. Kamaji is updated to edge-26.2.4 with full Kubernetes 1.35 support, and the CAPI Kamaji provider is updated to v0.16.0. A compatibility patch ensures kubelets older than v1.35 are not broken by Kamaji injecting 1.35-specific kubelet fields ([**@lexfrei**](https://github.com/lexfrei) in #2073).
-
-* **[platform] Make cluster issuer name and ACME solver configurable**: Added `publishing.certificates.solver` (`http01` or `dns01`) and `publishing.certificates.issuerName` (default: `letsencrypt-prod`) parameters to the platform chart. This allows operators to point all ingress TLS annotations at any ClusterIssuer — custom ACME, self-signed, or internal CA — without modifying individual package templates. See the Breaking Changes section for the rename from the previous `issuerType` field ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in #2077).
-
-* **[dashboard] VMInstance dropdowns for disks and instanceType**: The VM instance creation form now renders API-backed dropdowns for the `instanceType` field (populated from `VirtualMachineClusterInstancetype` cluster resources) and for disk `name` fields (populated from `VMDisk` resources in the same namespace). Default values are read from the ApplicationDefinition's OpenAPI schema. This eliminates manual lookups and reduces misconfiguration when attaching disks or selecting VM instance types ([**@sircthulhu**](https://github.com/sircthulhu) in #2071).
-
-* **[installer] Remove CRDs from Helm chart, delegate lifecycle to operator**: The `cozy-installer` Helm chart no longer ships CRDs in its `crds/` directory. CRD lifecycle is now fully managed by the Cozystack operator via the `--install-crds` flag, which applies embedded CRD manifests on every startup using server-side apply. The platform PackageSource is also created by the operator instead of a Helm template. This ensures CRDs and the PackageSource are always up to date after each operator restart, eliminating stale CRDs from Helm's install-only behavior ([**@lexfrei**](https://github.com/lexfrei) in #2074).
-
-## Fixes
-
-* **[kubevirt] Update KubeVirt to v1.6.4 and CDI to v1.64.0, fix VM pod initialization**: Updated KubeVirt operator to v1.6.4 and CDI operator to v1.64.0, including live migration of existing VMs during the upgrade. Additionally, disabled serial console logging globally via the KubeVirt CR to prevent a known v1.6.x issue ([upstream #15989](https://github.com/kubevirt/kubevirt/issues/15989)) where the `guest-console-log` init container blocked virt-launcher pods from starting, causing all VMs to get stuck in `PodInitializing` state ([**@nbykov0**](https://github.com/nbykov0) in #1833; [**@kvaps**](https://github.com/kvaps) in 7dfb819).
-
-* **[linstor] Fix DRBD+LUKS+STORAGE resource creation failure**: All newly created encrypted volumes were failing because the DRBD `.res` file was never written due to a missing `setExists(true)` call in the `LuksLayer`. Applied the upstream `skip-adjust-when-device-inaccessible` patch ([LINBIT/linstor-server#477](https://github.com/LINBIT/linstor-server/pull/477)) which fixes the root cause and also prevents unnecessary lsblk calls when devices are not yet physically present ([**@kvaps**](https://github.com/kvaps) in #2072).
-
-* **[system] Fix monitoring-agents FQDN resolution for tenant workload clusters**: Monitoring agents (`vmagent`, `fluent-bit`) in tenant workload clusters were failing to deliver metrics and logs because service addresses used short DNS names without the cluster domain suffix. Fixed by appending the configured cluster domain from `_cluster.cluster-domain` (with fallback to `cluster.local`) to all vmagent remoteWrite URLs and fluent-bit output hosts ([**@IvanHunters**](https://github.com/IvanHunters) in #2075).
-
-* **[cozystack-basics] Preserve existing HelmRelease values during reconciliations**: Fixed a data-loss bug where changes made to the `tenant-root` HelmRelease were silently dropped on the next forced or upgrade reconciliation of the `cozystack-basics` HelmRelease. The reconciler now merges new configuration with existing values instead of overwriting them ([**@sircthulhu**](https://github.com/sircthulhu) in #2068).
-
-* **[cozystack-basics] Deny resourcequotas deletion for tenant admin**: Fixed the `cozy:tenant:admin:base` ClusterRole to explicitly deny deletion of `ResourceQuota` objects for tenant admins and superadmins, preventing accidental removal of tenant resource limits ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in #2076).
-
-## Breaking Changes & Upgrade Notes
-
-* **[platform] Certificate issuer configuration parameters renamed**: The `publishing.certificates.issuerType` field is renamed to `publishing.certificates.solver`, and the value `cloudflare` is renamed to `dns01` to align with standard ACME terminology. A new `publishing.certificates.issuerName` field (default: `letsencrypt-prod`) is introduced to allow pointing all ingresses at a custom ClusterIssuer. Migration 32 is included and automatically converts existing configurations during upgrade — no manual action is required ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in #2077).
-
-## Documentation
-
-* **[website] Migrate ConfigMap references to Platform Package in v1 documentation**: Updated the entire v1 documentation tree to replace legacy ConfigMap-based configuration references with the new Platform Package API, ensuring guides are consistent with the v1 configuration model ([**@sircthulhu**](https://github.com/sircthulhu) in cozystack/website#426).
-
-* **[website] Add generic Kubernetes deployment guide for v1**: Added a new installation guide covering Cozystack deployment on any generic Kubernetes cluster, expanding the set of supported deployment targets beyond provider-specific guides ([**@lexfrei**](https://github.com/lexfrei) in cozystack/website#408).
-
-* **[website] Refactor resource planning documentation**: Improved the resource planning guide with a clearer structure and more comprehensive coverage of planning considerations for Cozystack deployments ([**@IvanStukov**](https://github.com/IvanStukov) in cozystack/website#423).
-
-* **[website] Add ServiceAccount API access documentation and update FAQ**: Added a new article documenting ServiceAccount API access token configuration and updated the FAQ to include related troubleshooting guidance ([**@IvanStukov**](https://github.com/IvanStukov) in cozystack/website#421).
-
-* **[website] Update networking-mesh allowed-location-ips example**: Replaced provider-specific CLI usage with standard `kubectl` commands in the multi-location networking guide's `allowed-location-ips` example, making the documentation more universally applicable ([**@kvaps**](https://github.com/kvaps) in cozystack/website#425).
-
-## Contributors
-
-We'd like to thank all contributors who made this release possible:
-
-* [**@IvanHunters**](https://github.com/IvanHunters)
-* [**@IvanStukov**](https://github.com/IvanStukov)
-* [**@kvaps**](https://github.com/kvaps)
-* [**@lexfrei**](https://github.com/lexfrei)
-* [**@myasnikovdaniil**](https://github.com/myasnikovdaniil)
-* [**@nbykov0**](https://github.com/nbykov0)
-* [**@sircthulhu**](https://github.com/sircthulhu)
-
-### New Contributors
-
-We're excited to welcome our first-time contributors:
-
-* [**@myasnikovdaniil**](https://github.com/myasnikovdaniil) - First contribution!
-
-**Full Changelog**: https://github.com/cozystack/cozystack/compare/v1.0.0-beta.6...v1.0.0-rc.1

docs/changelogs/v1.0.0-rc.2.md

@@ -1,57 +0,0 @@
-<!--
-https://github.com/cozystack/cozystack/releases/tag/v1.0.0-rc.2
--->
-
-> **⚠️ Release Candidate Warning**: This is a release candidate intended for final validation before the stable v1.0.0 release. Breaking changes are not expected at this stage, but please test thoroughly before deploying to production.
-
-## Features and Improvements
-
-* **[keycloak] Allow custom Ingress hostname via values**: Added an `ingress.host` field to the cozy-keycloak chart values, allowing operators to override the default `keycloak.<root-host>` Ingress hostname. The custom hostname is applied to both the Ingress resource and the `KC_HOSTNAME` environment variable in the StatefulSet. When left empty, the original behavior is preserved (fully backward compatible) ([**@sircthulhu**](https://github.com/sircthulhu) in #2101).
-
-## Fixes
-
-* **[platform] Fix upgrade issues in migrations, etcd timeout, and migration script**: Fixed multiple upgrade failures discovered during v0.41.1 → v1.0 upgrade testing. Migration 26 now uses the `cozystack.io/ui=true` label (always present on v0.41.1) instead of the new label that depends on migration 22 having run, and adds robust Helm secret deletion with fallback and verification. Migrations 28 and 29 wrap `grep` calls to prevent `pipefail` exits and fix the reconcile annotation to use RFC3339 format. Migration 27 now skips missing CRDs and adds a name-pattern fallback for Helm secret deletion. The etcd HelmRelease timeout is increased from 10m to 30m to accommodate TLS cert rotation hooks. The `migrate-to-version-1.0.sh` script gains the missing `bundle-disable`, `bundle-enable`, `expose-ingress`, and `expose-services` field mappings ([**@kvaps**](https://github.com/kvaps) in #2096).
-
-* **[platform] Fix orphaned -rd HelmReleases after application renames**: After the `ferretdb→mongodb`, `mysql→mariadb`, and `virtual-machine→vm-disk+vm-instance` renames, the system-level `-rd` HelmReleases in `cozy-system` (`ferretdb-rd`, `mysql-rd`, `virtual-machine-rd`) were left orphaned, referencing ExternalArtifacts that no longer exist and causing persistent reconciliation failures. Migrations 28 and 29 are updated to remove these resources, and migration 33 is added as a safety net for clusters that already passed those migrations ([**@kvaps**](https://github.com/kvaps) in #2102).
-
-* **[monitoring-agents] Fix FQDN resolution regression in tenant workload clusters**: The fix introduced in #2075 used `_cluster.cluster-domain` references in `values.yaml`, but `_cluster` values are not accessible from Helm subchart contexts — meaning fluent-bit received empty hostnames and failed to forward logs. This PR replaces the `_cluster` references with a new `global.clusterDomain` variable (empty by default for management clusters, set to the cluster domain for tenant clusters), which is correctly shared with all subcharts ([**@kvaps**](https://github.com/kvaps) in #2086).
-
-* **[dashboard] Fix legacy templating and cluster identifier in sidebar links**: Standardized the cluster identifier used across dashboard menu links, administration links, and API request paths, resolving incorrect or broken link targets for the Backups and External IPs sidebar sections ([**@androndo**](https://github.com/androndo) in #2093).
-
-* **[dashboard] Fix backupjobs creation form and sidebar backup category identifier**: Fixed the backup job creation form configuration, adding the required Name, Namespace, Plan Name, Application, and Backup Class fields. Fixed the sidebar backup category identifier that was causing incorrect navigation ([**@androndo**](https://github.com/androndo) in #2103).
-
-## Documentation
-
-* **[website] Add Helm chart development principles guide**: Added a new developer guide section documenting Cozystack's four core Helm chart principles: easy upstream updates, local-first artifacts, local dev/test workflow, and no external dependencies ([**@kvaps**](https://github.com/kvaps) in cozystack/website#418).
-
-* **[website] Add network architecture overview**: Added comprehensive network architecture documentation covering the multi-layered networking stack — MetalLB (L2/BGP), Cilium eBPF (kube-proxy replacement), Kube-OVN (centralized IPAM), and tenant isolation with identity-based eBPF policies — with Mermaid diagrams for all major traffic flows ([**@IvanHunters**](https://github.com/IvanHunters) in cozystack/website#422).
-
-* **[website] Update documentation to use jsonpatch for service exposure**: Improved `kubectl patch` commands throughout installation and configuration guides to use JSON Patch `add` operations for extending arrays instead of replacing them wholesale, making the documented commands safer and more precise ([**@sircthulhu**](https://github.com/sircthulhu) in cozystack/website#427).
-
-* **[website] Update certificates section in Platform Package documentation**: Updated the certificate configuration documentation to reflect the new `solver` and `issuerName` fields introduced in v1.0.0-rc.1, replacing the legacy `issuerType` references ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in cozystack/website#429).
-
-* **[website] Add tenant Kubernetes cluster log querying guide**: Added documentation for querying logs from tenant Kubernetes clusters in Grafana using VictoriaLogs labels (`tenant`, `kubernetes_namespace_name`, `kubernetes_pod_name`), including the `monitoringAgents` addon prerequisite and step-by-step filtering examples ([**@IvanHunters**](https://github.com/IvanHunters) in cozystack/website#430).
-
-* **[website] Replace non-idempotent commands with idempotent alternatives**: Updated `helm install` to `helm upgrade --install`, `kubectl create -f` to `kubectl apply -f`, and `kubectl create ns` to the dry-run+apply pattern across all installation and deployment guides so commands can be safely re-run ([**@lexfrei**](https://github.com/lexfrei) in cozystack/website#431).
-
-* **[website] Fix broken documentation links with `.md` suffix**: Fixed incorrect internal links with `.md` suffix across virtualization guides for both v0 and v1 documentation, standardizing link text to "Developer Guide" ([**@cheese**](https://github.com/cheese) in cozystack/website#432).
-
-## Contributors
-
-We'd like to thank all contributors who made this release possible:
-
-* [**@androndo**](https://github.com/androndo)
-* [**@cheese**](https://github.com/cheese)
-* [**@IvanHunters**](https://github.com/IvanHunters)
-* [**@kvaps**](https://github.com/kvaps)
-* [**@lexfrei**](https://github.com/lexfrei)
-* [**@myasnikovdaniil**](https://github.com/myasnikovdaniil)
-* [**@sircthulhu**](https://github.com/sircthulhu)
-
-### New Contributors
-
-We're excited to welcome our first-time contributors:
-
-* [**@cheese**](https://github.com/cheese) - First contribution!
-
-**Full Changelog**: https://github.com/cozystack/cozystack/compare/v1.0.0-rc.1...v1.0.0-rc.2

docs/changelogs/v1.0.0.md

@@ -1,289 +0,0 @@
-<!--
-https://github.com/cozystack/cozystack/releases/tag/v1.0.0
--->
-
-# Cozystack v1.0.0 — "Stable"
-
-We are thrilled to announce **Cozystack v1.0.0**, the first stable major release of the Cozystack platform. This milestone represents a fundamental architectural evolution from the v0.x series, introducing a fully operator-driven package management system, a comprehensive backup and restore framework, a redesigned virtual machine architecture, and a rich set of new managed applications — all hardened through an extensive alpha, beta, and release-candidate cycle.
-
-## Feature Highlights
-
-### Package-Based Architecture with Cozystack Operator
-
-The most significant architectural change in v1.0.0 is the replacement of HelmRelease bundle deployments with a declarative **Package** and **PackageSource** model managed by the new `cozystack-operator`. Operators now define their platform configuration in a structured `values.yaml` and the operator reconciles the desired state by managing Package and PackageSource resources across the cluster.
-
-The operator also takes ownership of CRD lifecycle — installing and updating CRDs from embedded manifests at every startup — eliminating the stale-CRD problem that affected Helm-only installations. Flux sharding has been added to distribute tenant HelmRelease reconciliation across multiple Flux controllers, providing horizontal scalability in large multi-tenant environments.
-
-A migration script (`hack/migrate-to-version-1.0.sh`) is provided for upgrading existing v0.x clusters, along with 33 incremental migration steps that automate resource renaming, secret cleanup, and configuration conversion.
-
-### Comprehensive Backup and Restore System
-
-v1.0.0 ships a fully featured, production-ready backup and restore framework built on Velero integration. Users can define **BackupClass** resources to describe backup storage targets, create **BackupPlan** schedules, and trigger **RestoreJob** resources for end-to-end application recovery.
-
-Virtual machine backups are supported natively via the Velero KubeVirt plugin, which captures consistent VM disk snapshots alongside metadata. The backup controller and the backup strategy sub-controllers (including the VM-specific strategy) are installed by default, and a full dashboard UI allows users to monitor backup status, view backup job history, and initiate restore workflows.
-
-### Redesigned Virtual Machine Architecture
-
-The legacy `virtual-machine` application has been replaced with a two-resource architecture: **`vm-disk`** for managing persistent disks and **`vm-instance`** for managing VM lifecycle. This separation provides cleaner disk/instance management, allows disks to be reused across VM instances, and aligns with modern KubeVirt patterns.
-
-New capabilities include: a `cpuModel` field for direct CPU model specification without using an instanceType; the ability to switch between `instanceType`-based and custom resource-based configurations; migration from the deprecated `running` field to `runStrategy`; and native **RWX (NFS) filesystem support** in the KubeVirt CSI driver, enabling multiple pods to mount the same persistent volume simultaneously.
-
-### New Managed Applications
-
-v1.0.0 expands the application catalog significantly:
-
-- **MongoDB**: A fully managed MongoDB replica set with persistent storage, monitoring integration, and unified user/database configuration API.
-- **Qdrant**: A high-performance vector database for AI and machine learning workloads, supporting single-replica and clustered modes with API key authentication and optional external LoadBalancer access.
-- **Harbor**: A fully managed OCI container registry backed by CloudNativePG, Redis operator, and COSI BucketClaim (SeaweedFS). Includes Trivy vulnerability scanner, auto-generated admin credentials, and TLS via cert-manager.
-- **NATS**: Enhanced with full Grafana monitoring dashboards for JetStream and server metrics, Prometheus support with TLS-aware configuration, and updated image customization options.
-- **MariaDB**: The `mysql` application is renamed to `mariadb`, accurately reflecting the underlying engine. An automatic migration (migration 27) converts all existing MySQL resources to use the `mariadb` naming.
-
-FerretDB has been removed from the catalog as it is superseded by native MongoDB support.
-
-### Multi-Location Networking with Kilo and cilium-kilo
-
-Cozystack v1.0.0 introduces first-class support for multi-location clusters via the **Kilo** WireGuard mesh networking package. Kilo automatically establishes encrypted WireGuard tunnels between nodes in different network segments, enabling seamless cross-region communication.
-
-A new integrated **`cilium-kilo`** networking variant combines Cilium eBPF CNI with Kilo's WireGuard overlay in a single platform configuration selection. This variant enables `enable-ipip-termination` in Cilium and deploys Kilo with `--compatibility=cilium`, allowing Cilium network policies to function correctly over the WireGuard mesh — without any manual configuration of the two components.
-
-### Flux Sharding for Scalable Multi-Tenancy
-
-Tenant HelmRelease reconciliation is now distributed across multiple Flux controllers via sharding labels. Each tenant workload is assigned to a shard based on a deterministic hash, preventing a single Flux controller from becoming a bottleneck in large multi-tenant environments. The platform operator manages the shard assignment automatically, and new shards can be added by scaling the Flux deployment.
-
-## Major Features and Improvements
-
-### Cozystack Operator
-
-* **[cozystack-operator] Introduce Package and PackageSource APIs**: Added new CRDs for declarative package management, defining the full API for Package and PackageSource resources ([**@kvaps**](https://github.com/kvaps) in #1740, #1741, #1755, #1756, #1760, #1761).
-* **[platform] Migrate from HelmRelease bundles to Package-based deployment**: Replaced HelmRelease bundle system with Package resources managed by cozystack-operator, including restructured values.yaml with full configuration support for networking, publishing, authentication, scheduling, branding, and resources ([**@kvaps**](https://github.com/kvaps) in #1816).
-* **[cozystack-operator] Add automatic CRD installation at startup**: Added `--install-crds` flag to install embedded CRD manifests on every startup via server-side apply, ensuring CRDs and the PackageSource are always up to date ([**@lexfrei**](https://github.com/lexfrei) in #2060).
-* **[installer] Remove CRDs from Helm chart, delegate lifecycle to operator**: The `cozy-installer` Helm chart no longer ships CRDs; CRD lifecycle is fully managed by the Cozystack operator ([**@lexfrei**](https://github.com/lexfrei) in #2074).
-* **[cozystack-operator] Preserve existing suspend field in package reconciler**: Fixed package reconciler to properly preserve the suspend field state during reconciliation ([**@sircthulhu**](https://github.com/sircthulhu) in #2043).
-* **[cozystack-operator] Fix namespace privileged flag resolution and field ownership**: Fixed operator to correctly check all Packages in a namespace when determining privileged status, and resolved SSA field ownership conflicts ([**@kvaps**](https://github.com/kvaps) in #2046).
-* **[platform] Add flux-plunger controller**: Added flux-plunger controller to automatically fix stuck HelmRelease errors by cleaning up failed resources and retrying reconciliation ([**@kvaps**](https://github.com/kvaps) in #1843).
-* **[installer] Add variant-aware templates for generic Kubernetes support**: Extended the installer to support generic and hosted Kubernetes deployments via the `cozystackOperator.variant=generic` parameter ([**@lexfrei**](https://github.com/lexfrei) in #2010).
-* **[installer] Unify operator templates**: Merged separate operator templates into a single variant-based template supporting Talos and non-Talos deployments ([**@kvaps**](https://github.com/kvaps) in #2034).
-
-### API and Platform
-
-* **[api] Rename CozystackResourceDefinition to ApplicationDefinition**: Renamed CRD and all related types for clarity and consistency, with migration 24 handling the transition automatically ([**@kvaps**](https://github.com/kvaps) in #1864).
-* **[platform] Add DNS-1035 validation for Application names**: Added dynamic DNS-1035 label validation for Application names at creation time, preventing resources with invalid names that would fail downstream ([**@lexfrei**](https://github.com/lexfrei) in #1771).
-* **[platform] Make cluster issuer name and ACME solver configurable**: Added `publishing.certificates.solver` and `publishing.certificates.issuerName` parameters to allow pointing all ingress TLS annotations at any ClusterIssuer ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in #2077).
-* **[platform] Add cilium-kilo networking variant**: Added integrated `cilium-kilo` networking variant combining Cilium CNI with Kilo WireGuard mesh overlay ([**@kvaps**](https://github.com/kvaps) in #2064).
-* **[cozystack-api] Switch from DaemonSet to Deployment**: Migrated cozystack-api to a Deployment with PreferClose topology spread constraints, reducing resource consumption while maintaining high availability ([**@kvaps**](https://github.com/kvaps) in #2041, #2048).
-
-### Virtual Machines
-
-* **[vm-instance] Complete migration from virtual-machine to vm-disk and vm-instance**: Fully migrated from `virtual-machine` to the new `vm-disk` and `vm-instance` architecture, with automatic migration script (migration 28) for existing VMs ([**@kvaps**](https://github.com/kvaps) in #2040).
-* **[kubevirt-csi-driver] Add RWX Filesystem (NFS) support**: Added Read-Write-Many filesystem support to kubevirt-csi-driver via automatic NFS server deployment per PVC ([**@kvaps**](https://github.com/kvaps) in #2042).
-* **[vm] Add cpuModel field to specify CPU model without instanceType**: Added cpuModel field to VirtualMachine API for granular CPU control ([**@sircthulhu**](https://github.com/sircthulhu) in #2007).
-* **[vm] Allow switching between instancetype and custom resources**: Implemented atomic upgrade hook for switching between instanceType-based and custom resource VM configurations ([**@sircthulhu**](https://github.com/sircthulhu) in #2008).
-* **[vm] Migrate to runStrategy instead of running**: Migrated VirtualMachine API from deprecated `running` field to `runStrategy` ([**@sircthulhu**](https://github.com/sircthulhu) in #2004).
-* **[vm] Always expose VMs with a service**: Virtual machines are now always exposed with at least a ClusterIP service, ensuring in-cluster DNS names ([**@lllamnyp**](https://github.com/lllamnyp) in #1738, #1751).
-* **[dashboard] VMInstance dropdowns for disks and instanceType**: VM instance creation form now renders API-backed dropdowns for `instanceType` and disk `name` fields ([**@sircthulhu**](https://github.com/sircthulhu) in #2071).
-
-### Backup System
-
-* **[backups] Implement comprehensive backup and restore functionality**: Core backup Plan controller, Velero strategy controller, RestoreJob resource with end-to-end restore workflows, and enhanced backup plans UI ([**@lllamnyp**](https://github.com/lllamnyp) in #1640, #1685, #1687, #1719, #1720, #1737, #1967; [**@androndo**](https://github.com/androndo) in #1762, #1967, #1968, #1811).
-* **[backups] Add kubevirt plugin to velero**: Added KubeVirt plugin to Velero for consistent VM state and data snapshots ([**@lllamnyp**](https://github.com/lllamnyp) in #2017).
-* **[backups] Install backupstrategy controller by default**: Enabled backupstrategy controller by default for automatic backup scheduling ([**@lllamnyp**](https://github.com/lllamnyp) in #2020).
-* **[backups] Better selectors for VM strategy**: Improved VM backup strategy selectors for accurate and reliable backup targeting ([**@lllamnyp**](https://github.com/lllamnyp) in #2023).
-* **[backups] Create RBAC for backup resources**: Added comprehensive RBAC configuration for backup operations and restore jobs ([**@lllamnyp**](https://github.com/lllamnyp) in #2018).
-
-### Networking
-
-* **[kilo] Introduce Kilo WireGuard mesh networking**: Added Kilo as a system package providing secure WireGuard-based VPN mesh for connecting Kubernetes nodes across different networks and regions ([**@kvaps**](https://github.com/kvaps) in #1691).
-* **[kilo] Add Cilium compatibility variant**: Added `cilium` variant enabling Cilium-aware IPIP encapsulation for full network policy enforcement with Kilo mesh ([**@kvaps**](https://github.com/kvaps) in #2055).
-* **[kilo] Update to v0.8.0 with configurable MTU**: Updated Kilo to v0.8.0 with configurable MTU parameter and performance improvements ([**@kvaps**](https://github.com/kvaps) in #2003, #2049, #2053).
-* **[local-ccm] Add local-ccm package**: Added local cloud controller manager for managing load balancer services in bare-metal environments ([**@kvaps**](https://github.com/kvaps) in #1831).
-* **[local-ccm] Add node-lifecycle-controller component**: Added optional node-lifecycle-controller that automatically deletes unreachable NotReady nodes, solving the "zombie" node problem in autoscaled clusters ([**@IvanHunters**](https://github.com/IvanHunters) in #1992).
-* **[tenant] Allow egress to parent ingress pods**: Updated tenant network policies to allow egress traffic to parent cluster ingress pods ([**@lexfrei**](https://github.com/lexfrei) in #1765, #1776).
-
-### New Applications
-
-* **[mongodb] Add MongoDB managed application**: Added MongoDB as a fully managed database with replica sets, persistent storage, and unified user/database configuration ([**@lexfrei**](https://github.com/lexfrei) in #1822; [**@kvaps**](https://github.com/kvaps) in #1923).
-* **[qdrant] Add Qdrant vector database**: Added Qdrant as a high-performance vector database for AI/ML workloads with API key authentication and optional LoadBalancer access ([**@lexfrei**](https://github.com/lexfrei) in #1987).
-* **[harbor] Add managed Harbor container registry**: Added Harbor v2.14.2 as a managed tenant-level container registry with CloudNativePG, Redis operator, COSI BucketClaim storage, and Trivy scanner ([**@lexfrei**](https://github.com/lexfrei) in #2058).
-* **[nats] Add monitoring**: Added Grafana dashboards for NATS JetStream and server metrics, Prometheus monitoring with TLS support ([**@klinch0**](https://github.com/klinch0) in #1381).
-* **[mariadb] Rename mysql application to mariadb**: Renamed MySQL application to MariaDB with automatic migration (migration 27) for all existing resources ([**@kvaps**](https://github.com/kvaps) in #2026).
-* **[ferretdb] Remove FerretDB application**: Removed FerretDB, superseded by native MongoDB support ([**@kvaps**](https://github.com/kvaps) in #2028).
-
-### Kubernetes and System Components
-
-* **[kubernetes] Update supported Kubernetes versions to v1.30–v1.35**: Updated the tenant Kubernetes version matrix, with v1.35 as the new default. Kamaji updated to edge-26.2.4 and CAPI Kamaji provider to v0.16.0 ([**@lexfrei**](https://github.com/lexfrei) in #2073).
-* **[kubernetes] Auto-enable Gateway API support in cert-manager**: Added automatic Gateway API support in cert-manager for tenant clusters ([**@kvaps**](https://github.com/kvaps) in #1997).
-* **[kubernetes] Use ingress-nginx nodeport service**: Changed tenant Kubernetes clusters to use ingress-nginx NodePort service for improved compatibility ([**@sircthulhu**](https://github.com/sircthulhu) in #1948).
-* **[system] Add cluster-autoscaler for Hetzner and Azure**: Added cluster-autoscaler system package for automatically scaling management cluster nodes on Hetzner and Azure ([**@kvaps**](https://github.com/kvaps) in #1964).
-* **[cluster-autoscaler] Enable enforce-node-group-min-size by default**: Ensures node groups are always scaled up to their configured minimum size ([**@kvaps**](https://github.com/kvaps) in #2050).
-* **[system] Add clustersecret-operator package**: Added clustersecret-operator for managing secrets across multiple namespaces ([**@sircthulhu**](https://github.com/sircthulhu) in #2025).
-
-### Monitoring
-
-* **[monitoring] Enable monitoring for core components**: Enhanced monitoring capabilities with dashboards and metrics for core Cozystack components ([**@IvanHunters**](https://github.com/IvanHunters) in #1937).
-* **[monitoring] Add SLACK_SEVERITY_FILTER and VMAgent for tenant monitoring**: Added SLACK_SEVERITY_FILTER for Slack alert filtering and VMAgent for tenant namespace metrics scraping ([**@IvanHunters**](https://github.com/IvanHunters) in #1712).
-* **[monitoring-agents] Fix FQDN resolution for tenant workload clusters**: Fixed monitoring agents in tenant clusters to use full DNS names with cluster domain suffix ([**@IvanHunters**](https://github.com/IvanHunters) in #2075; [**@kvaps**](https://github.com/kvaps) in #2086).
-
-### Storage
-
-* **[linstor] Move CRDs to dedicated piraeus-operator-crds chart**: Moved LINSTOR CRDs to a dedicated chart, ensuring reliable installation of all CRDs including `linstorsatellites.io` ([**@kvaps**](https://github.com/kvaps) in #2036; [**@IvanHunters**](https://github.com/IvanHunters) in #1991).
-* **[seaweedfs] Increase certificate duration to 10 years**: Increased SeaweedFS certificate validity to 10 years to reduce rotation overhead ([**@IvanHunters**](https://github.com/IvanHunters) in #1986).
-
-## Improvements
-
-* **[dashboard] Upgrade dashboard to version 1.4.0**: Updated Cozystack dashboard to v1.4.0 with new features and improvements ([**@sircthulhu**](https://github.com/sircthulhu) in #2051).
-* **[dashboard] Hide Ingresses/Services/Secrets tabs when no selectors defined**: Tabs are now conditionally shown based on whether the ApplicationDefinition has resource selectors configured, reducing UI clutter ([**@kvaps**](https://github.com/kvaps) in #2087).
-* **[dashboard] Add startupProbe to prevent container restarts on slow hardware**: Added startup probe to dashboard pods to prevent unnecessary restarts ([**@kvaps**](https://github.com/kvaps) in #1996).
-* **[keycloak] Allow custom Ingress hostname via values**: Added `ingress.host` field to cozy-keycloak chart values for overriding the default `keycloak.<root-host>` hostname ([**@sircthulhu**](https://github.com/sircthulhu) in #2101).
-* **[branding] Separate values for Keycloak**: Separated Keycloak branding values for better customization capabilities ([**@nbykov0**](https://github.com/nbykov0) in #1947).
-* **[rbac] Use hierarchical naming scheme**: Refactored RBAC to use hierarchical naming for cluster roles and role bindings ([**@lllamnyp**](https://github.com/lllamnyp) in #2019).
-* **[tenant,rbac] Use shared clusterroles**: Refactored tenant RBAC to use shared ClusterRoles for improved consistency ([**@lllamnyp**](https://github.com/lllamnyp) in #1999).
-* **[kubernetes] Increase default apiServer resourcesPreset to large**: Increased kube-apiserver resource preset to `large` for more reliable operation under higher workloads ([**@kvaps**](https://github.com/kvaps) in #1875).
-* **[kubernetes] Increase kube-apiserver startup probe threshold**: Increased startup probe threshold to allow more time for API server readiness ([**@kvaps**](https://github.com/kvaps) in #1876).
-* **[etcd] Increase probe thresholds for better recovery**: Increased etcd probe thresholds to improve cluster resilience during temporary slowdowns ([**@kvaps**](https://github.com/kvaps) in #1874).
-* **[etcd-operator] Add vertical-pod-autoscaler dependency**: Added VPA as a dependency to etcd-operator for proper resource scaling ([**@sircthulhu**](https://github.com/sircthulhu) in #2047).
-* **[cilium] Change cilium-operator replicas to 1**: Reduced Cilium operator replicas to decrease resource consumption in smaller deployments ([**@IvanHunters**](https://github.com/IvanHunters) in #1784).
-* **[keycloak-configure,dashboard] Enable insecure TLS verification by default**: Made SSL certificate verification configurable with insecure mode enabled by default for local development ([**@IvanHunters**](https://github.com/IvanHunters) in #2005).
-* **[platform] Split telemetry between operator and controller**: Separated telemetry collection for better metrics isolation ([**@kvaps**](https://github.com/kvaps) in #1869).
-* **[system] Add resource requests and limits to etcd-defrag**: Added resource requests and limits to etcd-defrag job to prevent resource contention ([**@matthieu-robin**](https://github.com/matthieu-robin) in #1785, #1786).
-
-## Fixes
-
-* **[dashboard] Fix sidebar visibility on cluster-level pages**: Fixed broken URLs with double `//` on cluster-level pages by hiding namespace-scoped sidebar items when no tenant is selected ([**@sircthulhu**](https://github.com/sircthulhu) in #2106).
-* **[platform] Fix upgrade issues in migrations, etcd timeout, and migration script**: Fixed multiple upgrade failures discovered during v0.41.1 → v1.0 upgrade testing, including migration 26-29 fixes, RFC3339 format for annotations, and extended etcd HelmRelease timeout to 30m ([**@kvaps**](https://github.com/kvaps) in #2096).
-* **[platform] Fix orphaned -rd HelmReleases after application renames**: Migrations 28-29 updated to remove orphaned `-rd` HelmReleases in `cozy-system` after `ferretdb→mongodb`, `mysql→mariadb`, and `virtual-machine→vm-disk+vm-instance` renames, with migration 33 as a safety net ([**@kvaps**](https://github.com/kvaps) in #2102).
-* **[platform] Adopt tenant-root into cozystack-basics during migration**: Added migration 31 to adopt existing `tenant-root` Namespace and HelmRelease into `cozystack-basics` for a safe v0.41.x → v1.0 upgrade path ([**@kvaps**](https://github.com/kvaps) in #2065).
-* **[platform] Preserve tenant-root HelmRelease during migration**: Fixed data-loss risk during migration where `tenant-root` HelmRelease could be deleted ([**@sircthulhu**](https://github.com/sircthulhu) in #2063).
-* **[platform] Fix cozystack-values secret race condition**: Fixed race condition in cozystack-values secret creation that could cause initialization failures ([**@lllamnyp**](https://github.com/lllamnyp) in #2024).
-* **[cozystack-basics] Preserve existing HelmRelease values during reconciliations**: Fixed data-loss bug where changes to `tenant-root` HelmRelease were dropped on the next reconciliation ([**@sircthulhu**](https://github.com/sircthulhu) in #2068).
-* **[cozystack-basics] Deny resourcequotas deletion for tenant admin**: Fixed `cozy:tenant:admin:base` ClusterRole to explicitly deny deletion of ResourceQuota objects ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in #2076).
-* **[dashboard] Fix legacy templating and cluster identifier in sidebar links**: Standardized cluster identifier across dashboard menu links resolving broken link targets for Backups and External IPs ([**@androndo**](https://github.com/androndo) in #2093).
-* **[dashboard] Fix backupjobs creation form and sidebar backup category identifier**: Fixed backup job creation form fields and fixed sidebar backup category identifier ([**@androndo**](https://github.com/androndo) in #2103).
-* **[kubevirt] Update KubeVirt to v1.6.4 and CDI to v1.64.0, fix VM pod initialization**: Updated KubeVirt and CDI and disabled serial console logging globally to fix the `guest-console-log` init container blocking virt-launcher pods ([**@nbykov0**](https://github.com/nbykov0) in #1833; [**@kvaps**](https://github.com/kvaps)).
-* **[linstor] Fix DRBD+LUKS+STORAGE resource creation failure**: Applied upstream fix for all newly created encrypted volumes failing due to missing `setExists(true)` call in `LuksLayer` ([**@kvaps**](https://github.com/kvaps) in #2072).
-* **[platform] Clean up Helm secrets for removed releases**: Added cleanup logic to migration 23 to remove orphaned Helm secrets from removed `-rd` releases ([**@kvaps**](https://github.com/kvaps) in #2035).
-* **[monitoring] Fix YAML parse error in vmagent template**: Fixed YAML parsing error in monitoring-agents vmagent template ([**@kvaps**](https://github.com/kvaps) in #2037).
-* **[monitoring] Remove cozystack-controller dependency**: Fixed monitoring package to remove unnecessary cozystack-controller dependency ([**@IvanHunters**](https://github.com/IvanHunters) in #1990).
-* **[monitoring] Remove duplicate dashboards.list**: Fixed duplicate dashboards.list configuration in extra/monitoring package ([**@IvanHunters**](https://github.com/IvanHunters) in #2016).
-* **[linstor] Update piraeus-server patches with critical fixes**: Backported critical patches fixing edge cases in device management and DRBD resource handling ([**@kvaps**](https://github.com/kvaps) in #1850).
-* **[apiserver] Fix Watch resourceVersion and bookmark handling**: Fixed Watch API handling of resourceVersion and bookmarks for proper event streaming ([**@kvaps**](https://github.com/kvaps) in #1860).
-* **[bootbox] Auto-create bootbox-application as dependency**: Fixed bootbox package to automatically create required bootbox-application dependency ([**@kvaps**](https://github.com/kvaps) in #1974).
-* **[postgres-operator] Correct PromQL syntax in CNPGClusterOffline alert**: Fixed incorrect PromQL syntax in the CNPGClusterOffline Prometheus alert ([**@mattia-eleuteri**](https://github.com/mattia-eleuteri) in #1981).
-* **[coredns] Fix serviceaccount to match kubernetes bootstrap RBAC**: Fixed CoreDNS service account to correctly match Kubernetes bootstrap RBAC requirements ([**@mattia-eleuteri**](https://github.com/mattia-eleuteri) in #1958).
-* **[dashboard] Verify JWT token**: Added JWT token verification to dashboard for improved security ([**@lllamnyp**](https://github.com/lllamnyp) in #1980).
-* **[codegen] Fix missing gen_client in update-codegen.sh**: Fixed build error in `pkg/generated/applyconfiguration/utils.go` by including `gen_client` in the codegen script ([**@lexfrei**](https://github.com/lexfrei) in #2061).
-* **[kubevirt-operator] Fix typo in VMNotRunningFor10Minutes alert**: Fixed typo in VM alert name ensuring proper alert triggering ([**@lexfrei**](https://github.com/lexfrei) in #1770, #1775).
-
-## Security
-
-* **[dashboard] Verify JWT token**: Added JWT token verification to the dashboard for improved authentication security ([**@lllamnyp**](https://github.com/lllamnyp) in #1980).
-
-## Dependencies
-
-* **[cilium] Update to v1.18.6**: Updated Cilium CNI to v1.18.6 with security fixes and performance improvements ([**@sircthulhu**](https://github.com/sircthulhu) in #1868).
-* **[kube-ovn] Update to v1.15.3**: Updated Kube-OVN CNI to v1.15.3 with performance improvements and bug fixes ([**@kvaps**](https://github.com/kvaps) in #2022).
-* **[kilo] Update to v0.8.0**: Updated Kilo WireGuard mesh to v0.8.0 with performance improvements and new compatibility features ([**@kvaps**](https://github.com/kvaps) in #2053).
-* **Update Talos Linux to v1.12.1**: Updated Talos Linux to v1.12.1 with latest features and security patches ([**@kvaps**](https://github.com/kvaps) in #1877).
-
-## System Configuration
-
-* **[vpc] Migrate subnets definition from map to array format**: Migrated VPC subnets from `map[string]Subnet` to `[]Subnet` with explicit `name` field, with automatic migration via migration 30 ([**@kvaps**](https://github.com/kvaps) in #2052).
-* **[migrations] Add migrations 23-33 for v1.0 upgrade path**: Added 11 incremental migrations handling CRD ownership, resource renaming, secret cleanup, Helm adoption, and configuration conversion for the v0.41.x → v1.0.0 upgrade path ([**@kvaps**](https://github.com/kvaps) in #1975, #2035, #2036, #2040, #2026, #2065, #2052, #2102).
-* **[tenant] Run cleanup job from system namespace**: Moved tenant cleanup job to system namespace for improved security and resource isolation ([**@lllamnyp**](https://github.com/lllamnyp) in #1774, #1777).
-
-## Development, Testing, and CI/CD
-
-* **[ci] Use GitHub Copilot CLI for changelog generation**: Automated changelog generation using GitHub Copilot CLI ([**@androndo**](https://github.com/androndo) in #1753).
-* **[ci] Choose runner conditional on label**: Added conditional runner selection in CI based on PR labels ([**@lllamnyp**](https://github.com/lllamnyp) in #1998).
-* **[e2e] Use helm install instead of kubectl apply for cozystack installation**: Replaced static YAML apply flow with direct `helm upgrade --install` of the installer chart in E2E tests ([**@lexfrei**](https://github.com/lexfrei) in #2060).
-* **[e2e] Make kubernetes test retries effective by cleaning up stale resources**: Fixed E2E test retries by adding pre-creation cleanup and increasing deployment wait timeout to 300s ([**@lexfrei**](https://github.com/lexfrei) in #2062).
-* **[e2e] Increase HelmRelease readiness timeout for kubernetes test**: Increased HelmRelease readiness timeout to prevent false failures on slower hardware ([**@lexfrei**](https://github.com/lexfrei) in #2033).
-* **[ci] Improve cozyreport functionality**: Enhanced cozyreport tool with improved reporting for CI/CD pipelines ([**@lllamnyp**](https://github.com/lllamnyp) in #2032).
-* **feat(cozypkg): add cross-platform build targets with version injection**: Added cross-platform build targets for cozypkg/cozyhr tool for linux/amd64, linux/arm64, darwin/amd64, darwin/arm64 ([**@kvaps**](https://github.com/kvaps) in #1862).
-* **refactor: move scripts to hack directory**: Reorganized scripts to the standard `hack/` location ([**@kvaps**](https://github.com/kvaps) in #1863).
-* **Update CODEOWNERS**: Updated CODEOWNERS to include new maintainers ([**@lllamnyp**](https://github.com/lllamnyp) in #1972; [**@IvanHunters**](https://github.com/IvanHunters) in #2015).
-* **[talm] Skip config loading for completion subcommands**: Fixed talm CLI to skip config loading for shell completion commands ([**@kitsunoff**](https://github.com/kitsunoff) in cozystack/talm#109).
-* **[talm] Fix metadata.id type casting in physical_links_info**: Fixed Prometheus query to properly cast metadata.id to string for regexMatch operations ([**@kvaps**](https://github.com/kvaps) in cozystack/talm#110).
-
-## Documentation
-
-* **[website] Add documentation versioning**: Implemented comprehensive documentation versioning with separate v0 and v1 documentation trees and a version selector in the UI ([**@IvanStukov**](https://github.com/IvanStukov) in cozystack/website#415).
-* **[website] Describe upgrade to v1.0**: Added detailed upgrade instructions for migrating from v0.x to v1.0 ([**@nbykov0**](https://github.com/nbykov0) in cozystack/website@21bbe84).
-* **[website] Migrate ConfigMap references to Platform Package in v1 docs**: Updated entire v1 documentation to replace legacy ConfigMap-based configuration with the new Platform Package API ([**@sircthulhu**](https://github.com/sircthulhu) in cozystack/website#426).
-* **[website] Add generic Kubernetes deployment guide for v1**: Added installation guide for deploying Cozystack on any generic Kubernetes cluster ([**@lexfrei**](https://github.com/lexfrei) in cozystack/website#408).
-* **[website] Describe operator-based and HelmRelease-based package patterns**: Added development documentation explaining operator-based and HelmRelease-based package patterns ([**@kvaps**](https://github.com/kvaps) in cozystack/website#413).
-* **[website] Add Helm chart development principles guide**: Added developer guide documenting Cozystack's four core Helm chart principles ([**@kvaps**](https://github.com/kvaps) in cozystack/website#418).
-* **[website] Add network architecture overview**: Added comprehensive network architecture documentation covering the multi-layered networking stack with Mermaid diagrams ([**@IvanHunters**](https://github.com/IvanHunters) in cozystack/website#422).
-* **[website] Add LINSTOR disk preparation guide**: Added comprehensive documentation for preparing disks for LINSTOR storage ([**@IvanHunters**](https://github.com/IvanHunters) in cozystack/website#411).
-* **[website] Add Proxmox VM migration guide**: Added detailed guide for migrating virtual machines from Proxmox to Cozystack ([**@IvanHunters**](https://github.com/IvanHunters) in cozystack/website#410).
-* **[website] Add cluster autoscaler documentation**: Added documentation for Hetzner setup with Talos, vSwitch, and Kilo mesh integration ([**@kvaps**](https://github.com/kvaps) in #1964).
-* **[website] Improve Azure autoscaling troubleshooting guide**: Enhanced Azure autoscaling documentation with serial console instructions and `az vmss update --custom-data` guidance ([**@kvaps**](https://github.com/kvaps) in cozystack/website#424).
-* **[website] Update multi-location documentation for cilium-kilo variant**: Updated multi-location networking docs to reflect the integrated `cilium-kilo` variant selection ([**@kvaps**](https://github.com/kvaps) in cozystack/website@02d63f0).
-* **[website] Update documentation to use jsonpatch for service exposure**: Improved `kubectl patch` commands to use JSON Patch `add` operations ([**@sircthulhu**](https://github.com/sircthulhu) in cozystack/website#427).
-* **[website] Update certificates section in Platform Package documentation**: Updated certificate configuration docs to reflect new `solver` and `issuerName` fields ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in cozystack/website#429).
-* **[website] Add tenant Kubernetes cluster log querying guide**: Added documentation for querying logs from tenant clusters in Grafana using VictoriaLogs labels ([**@IvanHunters**](https://github.com/IvanHunters) in cozystack/website#430).
-* **[website] Replace non-idempotent commands with idempotent alternatives**: Updated `helm install` to `helm upgrade --install` and `kubectl create` to `kubectl apply` across all installation guides ([**@lexfrei**](https://github.com/lexfrei) in cozystack/website#431).
-* **[website] Fix broken documentation links with .md suffix**: Fixed incorrect internal links across virtualization guides for v0 and v1 documentation ([**@cheese**](https://github.com/cheese) in cozystack/website#432).
-* **[website] Refactor resource planning documentation**: Improved resource planning guide with clearer structure and more comprehensive coverage ([**@IvanStukov**](https://github.com/IvanStukov) in cozystack/website#423).
-* **[website] Add ServiceAccount API access documentation and update FAQ**: Added documentation for ServiceAccount API access token configuration and updated FAQ ([**@IvanStukov**](https://github.com/IvanStukov) in cozystack/website#421).
-* **[website] Update networking-mesh allowed-location-ips example**: Replaced provider-specific CLI with standard `kubectl` commands in multi-location networking guide ([**@kvaps**](https://github.com/kvaps) in cozystack/website#425).
-* **[website] docs(storage): simplify NFS driver setup instructions**: Simplified NFS driver setup documentation ([**@kvaps**](https://github.com/kvaps) in cozystack/website#399).
-* **[website] Add Hetzner RobotLB documentation**: Added documentation for configuring public IP with Hetzner RobotLB ([**@kvaps**](https://github.com/kvaps) in cozystack/website#394).
-* **[website] Add documentation for creating and managing cloned VMs**: Added comprehensive guide for VM cloning operations ([**@sircthulhu**](https://github.com/sircthulhu) in cozystack/website#401).
-* **[website] Update Talos installation docs for Hetzner and Servers.com**: Updated installation documentation for Hetzner and Servers.com environments ([**@kvaps**](https://github.com/kvaps) in cozystack/website#395).
-* **[website] Add Hidora organization support details**: Added Hidora to the support page ([**@matthieu-robin**](https://github.com/matthieu-robin) in cozystack/website#397, cozystack/website#398).
-* **[website] Check quotas before an upgrade**: Added troubleshooting documentation for checking resource quotas before upgrades ([**@nbykov0**](https://github.com/nbykov0) in cozystack/website#405).
-* **[website] Update support documentation**: Updated support documentation with current contact information ([**@xrmtech-isk**](https://github.com/xrmtech-isk) in cozystack/website#420).
-* **[website] Correct typo in kubeconfig reference in Kubernetes installation guide**: Fixed documentation typo in kubeconfig reference ([**@shkarface**](https://github.com/shkarface) in cozystack/website#414).
-
-## Breaking Changes & Upgrade Notes
-
-* **[api] CozystackResourceDefinition renamed to ApplicationDefinition**: The `CozystackResourceDefinition` CRD has been renamed to `ApplicationDefinition`. Migration 24 handles the transition automatically during upgrade ([**@kvaps**](https://github.com/kvaps) in #1864).
-
-* **[platform] Certificate issuer configuration parameters renamed**: The `publishing.certificates.issuerType` field is renamed to `publishing.certificates.solver`, and the value `cloudflare` is renamed to `dns01`. A new `publishing.certificates.issuerName` field (default: `letsencrypt-prod`) is added. Migration 32 automatically converts existing configurations — no manual action required ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in #2077).
-
-* **[vpc] VPC subnets definition migrated from map to array format**: VPC subnets are now defined as `[]Subnet` with an explicit `name` field instead of `map[string]Subnet`. Migration 30 handles the conversion automatically ([**@kvaps**](https://github.com/kvaps) in #2052).
-
-* **[vm] virtual-machine application replaced by vm-disk and vm-instance**: The legacy `virtual-machine` application has been fully replaced. Migration 28 automatically converts existing VMs to the new architecture ([**@kvaps**](https://github.com/kvaps) in #2040).
-
-* **[mysql] mysql application renamed to mariadb**: Existing MySQL deployments are automatically renamed to MariaDB via migration 27 ([**@kvaps**](https://github.com/kvaps) in #2026).
-
-### Upgrade Guide
-
-To upgrade from v0.41.x to v1.0.0:
-1. **Backup your cluster** before upgrading.
-2. Run the provided migration script: `hack/migrate-to-version-1.0.sh`.
-3. The 33 incremental migration steps will automatically handle all resource renaming, configuration conversion, CRD adoption, and secret cleanup.
-4. Refer to the [upgrade documentation](https://cozystack.io/docs/v1/upgrade) for detailed instructions and troubleshooting.
-
-## Contributors
-
-We'd like to thank all contributors who made this release possible:
-
-* [**@androndo**](https://github.com/androndo)
-* [**@cheese**](https://github.com/cheese)
-* [**@IvanHunters**](https://github.com/IvanHunters)
-* [**@IvanStukov**](https://github.com/IvanStukov)
-* [**@kitsunoff**](https://github.com/kitsunoff)
-* [**@klinch0**](https://github.com/klinch0)
-* [**@kvaps**](https://github.com/kvaps)
-* [**@lexfrei**](https://github.com/lexfrei)
-* [**@lllamnyp**](https://github.com/lllamnyp)
-* [**@matthieu-robin**](https://github.com/matthieu-robin)
-* [**@mattia-eleuteri**](https://github.com/mattia-eleuteri)
-* [**@myasnikovdaniil**](https://github.com/myasnikovdaniil)
-* [**@nbykov0**](https://github.com/nbykov0)
-* [**@shkarface**](https://github.com/shkarface)
-* [**@sircthulhu**](https://github.com/sircthulhu)
-* [**@xrmtech-isk**](https://github.com/xrmtech-isk)
-
-### New Contributors
-
-We're excited to welcome our first-time contributors:
-
-* [**@cheese**](https://github.com/cheese) - First contribution!
-* [**@IvanStukov**](https://github.com/IvanStukov) - First contribution!
-* [**@kitsunoff**](https://github.com/kitsunoff) - First contribution!
-* [**@shkarface**](https://github.com/shkarface) - First contribution!
-* [**@xrmtech-isk**](https://github.com/xrmtech-isk) - First contribution!
-
-**Full Changelog**: https://github.com/cozystack/cozystack/compare/v0.41.0...v1.0.0

docs/changelogs/v1.0.1.md

@@ -1,21 +0,0 @@
-<!--
-https://github.com/cozystack/cozystack/releases/tag/v1.0.1
--->
-
-## Fixes
-
-* **[platform] Prevent cozystack-version ConfigMap from deletion**: Added resource protection to prevent the `cozystack-version` ConfigMap from being accidentally deleted, improving platform stability and reliability ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in #2112, #2114).
-
-* **[installer] Add keep annotation to Namespace and update migration script**: Added `helm.sh/resource-policy: keep` annotation to the `cozy-system` Namespace in the installer Helm chart to prevent Helm from deleting the namespace (and all HelmReleases within it) when the installer release is removed. The v1.0 migration script is also updated to annotate the `cozy-system` namespace and `cozystack-version` ConfigMap with this policy before migration ([**@kvaps**](https://github.com/kvaps) in #2122, #2123).
-
-* **[dashboard] Add FlowSchema to exempt BFF from API throttling**: Added a `cozy-dashboard-exempt` FlowSchema to exempt the dashboard Back-End-for-Frontend (BFF) service account from Kubernetes API Priority and Fairness throttling. Previously, the BFF fell under the `workload-low` priority level, causing 429 (Too Many Requests) errors under load, resulting in dashboard unresponsiveness ([**@kvaps**](https://github.com/kvaps) in #2121, #2124).
-
-## Documentation
-
-* **[website] Replace bundles documentation with variants**: Renamed the "Bundles" documentation section to "Variants" to match current Cozystack terminology. Removed deprecated variants (`iaas-full`, `distro-full`, `distro-hosted`) and added new variants: `default` (PackageSources only, for manual package management via cozypkg) and `isp-full-generic` (full PaaS/IaaS on k3s, kubeadm, or RKE2). Updated all cross-references throughout the documentation ([**@kvaps**](https://github.com/kvaps) in cozystack/website#433).
-
-* **[website] Add step to protect namespace before upgrading**: Updated the cluster upgrade guide and v0.41→v1.0 migration guide with a required step to annotate the `cozy-system` namespace and `cozystack-version` ConfigMap with `helm.sh/resource-policy=keep` before running `helm upgrade`, preventing accidental namespace deletion ([**@kvaps**](https://github.com/kvaps) in cozystack/website#435).
-
----
-
-**Full Changelog**: https://github.com/cozystack/cozystack/compare/v1.0.0...v1.0.1