cozystack/docs/changelogs/v1.0.4.md

Fixes

• [system] Fix Keycloak probe crashloop with management port health endpoints: Fixed a crashloop where Keycloak 26.x was endlessly restarting because liveness and readiness probes were sending HTTP requests to port 8080. Keycloak 26.x redirects all requests on port 8080 to KC_HOSTNAME (HTTPS), and since kubelet does not follow redirects, probes failed, eventually triggering container restarts. The fix switches probes to the dedicated management port 9000 (/health/live, /health/ready) enabled via KC_HEALTH_ENABLED=true, exposes management port 9000, and adds a startupProbe with appropriate failure thresholds for better startup tolerance (@mattia-eleuteri in #2162, #2178).

• [system] Fix etcd-operator deprecated kube-rbac-proxy image: Replaced the deprecated gcr.io/kubebuilder/kube-rbac-proxy:v0.16.0 image with quay.io/brancz/kube-rbac-proxy:v0.18.1 in the vendored etcd-operator chart. The GCR-hosted image became unavailable after March 18, 2025, causing etcd-operator pods to fail on image pull (@kvaps in #2181, #2183).

• [platform] Fix VM MAC address not preserved during virtual-machine to vm-instance migration: During the virtual-machine → vm-instance migration (script 29), VM MAC addresses were not preserved. Kube-OVN reads MAC addresses exclusively from the pod annotation ovn.kubernetes.io/mac_address, not from spec.macAddress of the IP resource. Without this annotation, migrated VMs received a new random MAC address, breaking OS-level network configuration that matches by MAC (e.g., netplan). The fix adds a Helm lookup in the vm-instance chart template to read the Kube-OVN IP resource and automatically inject the MAC and IP addresses as pod annotations (@sircthulhu in #2169, #2191).

• [dashboard] Fix External IPs page showing empty rows: Fixed the External IPs administration page displaying empty rows instead of service data. The EnrichedTable configuration in the external-ips factory was using incorrect property names — replaced clusterNamePartOfUrl with cluster and changed pathToItems from array format to dot-path string format, matching the convention used by all other EnrichedTable instances (@IvanHunters in #2175, #2192).

• [dashboard] Fix disabled/hidden state reset on MarketplacePanel reconciliation: Fixed a bug where the dashboard controller was hardcoding disabled=false and hidden=false on every reconcile loop, overwriting changes made through the dashboard UI. Services disabled or hidden via the marketplace panel now correctly retain their state after controller reconciliation (@IvanHunters in #2176, #2202).

• [dashboard] Fix hidden MarketplacePanel resources appearing in sidebar menu: Fixed the sidebar navigation showing all resources regardless of their MarketplacePanel hidden state. The controller now fetches MarketplacePanels during sidebar reconciliation and filters out resources where hidden=true, ensuring that hiding a resource from the marketplace also removes it from the sidebar navigation. Listing failures are non-fatal — if the configuration fetch fails, no hiding is applied and the dashboard remains functional (@IvanHunters in #2177, #2204).

Documentation

• [website] Add OIDC self-signed certificates configuration guide: Added a comprehensive guide for configuring OIDC authentication with Keycloak when using self-signed certificates (the default in Cozystack). Covers Talos machine configuration with certificate mounting and host entries, kubelogin setup instructions, and a troubleshooting section. The guide is available for both v0 and v1 versioned documentation paths (@IvanHunters in cozystack/website#443).

---

Full Changelog: https://github.com/cozystack/cozystack/compare/v1.0.3...v1.0.4