@@ -0,0 +1,124 @@
+#!/usr/bin/env bats
+# The vendored CAPI provider packages ship the provider manifests twice: as the
+# readable YAML a reviewer reads, and as the gzip blob the chart actually mounts
+# into the cluster. `make components` writes both from one download, so they
+# agree at the moment of vendoring and nothing keeps them in step afterwards.
+#
+# An edit to the YAML alone is silent in every way that matters. The diff looks
+# right, review passes on it, and the cluster runs whatever the blob held —
+# which is the version nobody read. This asserts the two are the same bytes.
+#
+# The comparison is on the decompressed bytes, so the gzip header plays no part
+# in it. `make components` still passes -n, for a different reason: without it
+# the header carries a timestamp and every regeneration rewrites the committed
+# blob even when the input has not changed.
+
+REPO_ROOT="$(cd "$(dirname "${BATS_TEST_FILENAME:-$0}")/.." && pwd)"
+
+check_pair() {
+  local pkg="$1" yaml="$2"
+  local dir="$REPO_ROOT/packages/system/$pkg/files"
+
+  [ -f "$dir/$yaml" ]      || { echo "missing $pkg/files/$yaml" >&2; return 1; }
+  [ -f "$dir/components.gz" ] || { echo "missing $pkg/files/components.gz" >&2; return 1; }
+
+  local work; work="$(mktemp -d)"
+  gzip -dc "$dir/components.gz" > "$work/decompressed.yaml"
+
+  if ! cmp -s "$work/decompressed.yaml" "$dir/$yaml"; then
+    echo "$pkg: components.gz does not match $yaml" >&2
+    echo "the chart mounts the blob, so the cluster would run what the YAML does not say" >&2
+    if grep -q '^components:' "$REPO_ROOT/packages/system/$pkg/Makefile" 2>/dev/null; then
+      echo "run: make -C packages/system/$pkg components" >&2
+    else
+      echo "regenerate: gzip -9 -n -c files/$yaml > files/components.gz" >&2
+    fi
+    head -40 "$work/decompressed.yaml" > "$work/a"
+    head -40 "$dir/$yaml" > "$work/b"
+    diff "$work/a" "$work/b" | head -20 >&2 || true
+    rm -rf "$work"
+    return 1
+  fi
+  rm -rf "$work"
+}
+
+@test "capmox components.gz matches the vendored infrastructure-components.yaml" {
+  check_pair capi-providers-infraprovider-proxmox infrastructure-components.yaml
+}
+
+@test "in-cluster IPAM components.gz matches the vendored ipam-components.yaml" {
+  check_pair capi-providers-ipam-in-cluster ipam-components.yaml
+}
+
+# A version bump can land in git and never reach a cluster. capi-operator hashes
+# the provider spec and the config Secret into applied-spec-hash, and the
+# ConfigMap is in neither: bumping the Makefile and running `make components`
+# while spec.version and the ConfigMap name stay behind produces a release that
+# installs the old provider and reports the old version, with no error anywhere.
+# The three have to be one value, so this asserts they are.
+check_version() {
+  local pkg="$1" makefile_var="$2"
+  local dir="$REPO_ROOT/packages/system/$pkg"
+
+  local version
+  version="$(sed -n "s/^${makefile_var}=//p" "$dir/Makefile")"
+  [ -n "$version" ] || { echo "$pkg: no $makefile_var in Makefile" >&2; return 1; }
+
+  local cm_name provider_version
+  cm_name="$(sed -n 's/^  name: //p' "$dir/templates/configmaps.yaml")"
+  provider_version="$(sed -n 's/^  version: //p' "$dir/templates/providers.yaml")"
+
+  if [ "$cm_name" != "$provider_version" ]; then
+    echo "$pkg: ConfigMap name '$cm_name' and spec.version '$provider_version' differ" >&2
+    echo "fetchConfig would find no ConfigMap for the version the operator installs" >&2
+    return 1
+  fi
+
+  case "$cm_name" in
+    "$version"-*) ;;
+    *)
+      echo "$pkg: Makefile has $makefile_var=$version, the chart installs '$cm_name'" >&2
+      echo "the vendored files were regenerated without moving the version the operator reads" >&2
+      return 1
+      ;;
+  esac
+}
+
+@test "capmox ships the version its Makefile vendored" {
+  check_version capi-providers-infraprovider-proxmox CAPMOX_VERSION
+}
+
+@test "in-cluster IPAM ships the version its Makefile vendored" {
+  check_version capi-providers-ipam-in-cluster CAIP_VERSION
+}
+
+# The Makefile pins the SHA-256 of both release assets and `make components`
+# checks its downloads against them. The pin is only as good as the files it
+# describes, so the vendored copies are checked against it here as well: a
+# vendored file edited by hand, or a sum bumped without the file, both show up
+# without anyone running the refresh target.
+check_sums() {
+  local pkg="$1" makefile_var="$2" yaml="$3"
+  local dir="$REPO_ROOT/packages/system/$pkg"
+
+  local sum_components sum_metadata
+  sum_components="$(sed -n "s/^${makefile_var}_SHA256_COMPONENTS=//p" "$dir/Makefile")"
+  sum_metadata="$(sed -n "s/^${makefile_var}_SHA256_METADATA=//p" "$dir/Makefile")"
+  [ -n "$sum_components" ] && [ -n "$sum_metadata" ] \
+    || { echo "$pkg: Makefile pins no ${makefile_var}_SHA256_* sums" >&2; return 1; }
+
+  if ! printf '%s  %s\n%s  %s\n' "$sum_components" "$dir/files/$yaml" "$sum_metadata" "$dir/files/metadata.yaml" \
+      | sha256sum -c - >/dev/null 2>&1; then
+    echo "$pkg: a vendored file does not match the sum its Makefile pins" >&2
+    echo "either the file was edited without a refresh, or the sum moved without the file" >&2
+    return 1
+  fi
+}
+
+@test "capmox vendored files match the sums its Makefile pins" {
+  check_sums capi-providers-infraprovider-proxmox CAPMOX infrastructure-components.yaml
+}
+
+@test "in-cluster IPAM vendored files match the sums its Makefile pins" {
+  check_sums capi-providers-ipam-in-cluster CAIP ipam-components.yaml
+}
@@ -0,0 +1,30 @@
+---
+apiVersion: cozystack.io/v1alpha1
+kind: PackageSource
+metadata:
+  name: cozystack.capi-provider-infra-proxmox
+spec:
+  sourceRef:
+    kind: OCIRepository
+    name: cozystack-packages
+    namespace: cozy-system
+    path: /
+  variants:
+  # The kubevirt infra provider depends on cozystack.kubevirt because its VMs run
+  # inside this cluster. The proxmox one has no such edge: the hypervisor is
+  # external, reached over the Proxmox API with the credentials in the package's
+  # credentialsSecretName. What it does need is the IPAM provider — capmox
+  # allocates static addresses from an InClusterIPPool rather than using DHCP,
+  # so without it ProxmoxCluster never reaches Ready.
+  - name: default
+    dependsOn:
+    - cozystack.networking
+    - cozystack.capi-operator
+    - cozystack.capi-provider-ipam-in-cluster
+    components:
+    - name: capi-providers-infraprovider-proxmox
+      path: system/capi-providers-infraprovider-proxmox
+      install:
+        privileged: true
+        namespace: cozy-cluster-api
+        releaseName: capi-providers-infraprovider-proxmox
@@ -0,0 +1,27 @@
+---
+apiVersion: cozystack.io/v1alpha1
+kind: PackageSource
+metadata:
+  name: cozystack.capi-provider-ipam-in-cluster
+spec:
+  sourceRef:
+    kind: OCIRepository
+    name: cozystack-packages
+    namespace: cozy-system
+    path: /
+  variants:
+  # No infrastructure edge here on purpose: an IPAM provider is a generic Cluster
+  # API addon, and the only current consumer declares the dependency on its own
+  # side, so this variant stays reusable by any provider that assigns addresses
+  # instead of leasing them.
+  - name: default
+    dependsOn:
+    - cozystack.networking
+    - cozystack.capi-operator
+    components:
+    - name: capi-providers-ipam-in-cluster
+      path: system/capi-providers-ipam-in-cluster
+      install:
+        privileged: true
+        namespace: cozy-cluster-api
+        releaseName: capi-providers-ipam-in-cluster
@@ -218,6 +218,44 @@
 {{include "cozystack.platform.package.default" (list "cozystack.capi-provider-core" $) }}
 {{include "cozystack.platform.package.default" (list "cozystack.capi-provider-cp-kamaji" $) }}
 {{include "cozystack.platform.package.default" (list "cozystack.capi-provider-infra-kubevirt" $) }}
+{{- /*
+  The Proxmox infrastructure provider is opt-in where the KubeVirt one is not,
+  and the asymmetry is not a matter of taste. capmox talks to a hypervisor that
+  lives outside this cluster, and it needs a capmox-config Secret holding a
+  Proxmox API token: capi-operator reads that Secret before it installs
+  anything, so with no Secret the provider is never deployed at all. Enabling
+  this by default would ask every Cozystack install that has no Proxmox to
+  supply hypervisor credentials.
+
+  Enable it by adding cozystack.capi-provider-infra-proxmox to
+  bundles.enabledPackages. The in-cluster IPAM provider comes with it, for the
+  reason written next to the dependsOn edge in
+  sources/capi-provider-infra-proxmox.yaml. IPAM is also independently
+  enableable — it is a generic Cluster API addon, useful to any provider that
+  assigns rather than leases.
+*/ -}}
+{{- $proxmoxName := "cozystack.capi-provider-infra-proxmox" -}}
+{{- $ipamName := "cozystack.capi-provider-ipam-in-cluster" -}}
+{{- $pkgDisabled := default (list) .Values.bundles.disabledPackages -}}
+{{- $pkgEnabled := default (list) .Values.bundles.enabledPackages -}}
+{{- $proxmoxEnabled := and (has $proxmoxName $pkgEnabled) (not (has $proxmoxName $pkgDisabled)) -}}
+{{- /*
+  Naming the pair in conflicting lists is the one case worth stopping for. The
+  cluster catches it on its own: the capmox PackageSource depends on the IPAM
+  Package, so with that Package absent the capmox one goes Ready=False with
+  DependenciesNotReady and no HelmRelease is created. What it does not do is
+  say why. Failing the render names the two list entries that conflict, at the
+  moment someone writes them, instead of leaving a condition to decode later.
+*/ -}}
+{{- if and $proxmoxEnabled (has $ipamName $pkgDisabled) -}}
+{{- fail (printf "%s requires %s, which is listed in bundles.disabledPackages: capmox allocates worker addresses from an InClusterIPPool and has no DHCP mode, so without the IPAM provider no ProxmoxCluster ever becomes Ready" $proxmoxName $ipamName) -}}
+{{- end -}}
+{{- if or $proxmoxEnabled (has $ipamName $pkgEnabled) }}
+{{include "cozystack.platform.package.default" (list $ipamName $) }}
+{{- end }}
+{{- if $proxmoxEnabled }}
+{{include "cozystack.platform.package.default" (list $proxmoxName $) }}
+{{- end }}
 {{include "cozystack.platform.package" (list "cozystack.kubernetes-application" "kubevirt" $) }}
 {{include "cozystack.platform.package" (list "cozystack.kubernetes-nodes-application" "kubevirt" $) }}
 {{include "cozystack.platform.package" (list "cozystack.computeplane-application" "kubevirt" $) }}
 
@@ -0,0 +1,129 @@
+suite: bundles.iaas proxmox substrate wiring
+# capmox is opt-in where the KubeVirt infra provider is not: it drives a
+# hypervisor outside this cluster and does nothing without a Proxmox API token.
+# What is pinned here is that opting in is enough — the IPAM provider it cannot
+# work without comes along — and that opting in halfway stops the render instead
+# of parking a Package at Ready=False with DependenciesNotReady and no message
+# naming the two list entries that conflict.
+templates:
+  - templates/bundles/iaas.yaml
+release:
+  name: cozystack
+  namespace: cozy-system
+tests:
+  - it: ships neither package by default
+    set:
+      bundles:
+        system:
+          enabled: true
+          variant: isp-full
+        iaas:
+          enabled: true
+        enabledPackages: []
+    asserts:
+      - containsDocument:
+          apiVersion: cozystack.io/v1alpha1
+          kind: Package
+          name: cozystack.capi-provider-infra-proxmox
+          any: true
+        not: true
+      - containsDocument:
+          apiVersion: cozystack.io/v1alpha1
+          kind: Package
+          name: cozystack.capi-provider-ipam-in-cluster
+          any: true
+        not: true
+      # The KubeVirt provider stays unconditional — this wiring must not have
+      # made the default substrate opt-in by accident.
+      - containsDocument:
+          apiVersion: cozystack.io/v1alpha1
+          kind: Package
+          name: cozystack.capi-provider-infra-kubevirt
+          any: true
+
+  - it: pulls in the IPAM provider when capmox is enabled
+    set:
+      bundles:
+        system:
+          enabled: true
+          variant: isp-full
+        iaas:
+          enabled: true
+        enabledPackages:
+          - cozystack.capi-provider-infra-proxmox
+    asserts:
+      - containsDocument:
+          apiVersion: cozystack.io/v1alpha1
+          kind: Package
+          name: cozystack.capi-provider-infra-proxmox
+          any: true
+      - containsDocument:
+          apiVersion: cozystack.io/v1alpha1
+          kind: Package
+          name: cozystack.capi-provider-ipam-in-cluster
+          any: true
+
+  - it: emits the IPAM provider on its own, without dragging capmox in
+    set:
+      bundles:
+        system:
+          enabled: true
+          variant: isp-full
+        iaas:
+          enabled: true
+        enabledPackages:
+          - cozystack.capi-provider-ipam-in-cluster
+    asserts:
+      - containsDocument:
+          apiVersion: cozystack.io/v1alpha1
+          kind: Package
+          name: cozystack.capi-provider-ipam-in-cluster
+          any: true
+      - containsDocument:
+          apiVersion: cozystack.io/v1alpha1
+          kind: Package
+          name: cozystack.capi-provider-infra-proxmox
+          any: true
+        not: true
+
+  - it: emits neither when capmox is enabled and disabled at once
+    set:
+      bundles:
+        system:
+          enabled: true
+          variant: isp-full
+        iaas:
+          enabled: true
+        enabledPackages:
+          - cozystack.capi-provider-infra-proxmox
+        disabledPackages:
+          - cozystack.capi-provider-infra-proxmox
+    asserts:
+      - containsDocument:
+          apiVersion: cozystack.io/v1alpha1
+          kind: Package
+          name: cozystack.capi-provider-infra-proxmox
+          any: true
+        not: true
+      - containsDocument:
+          apiVersion: cozystack.io/v1alpha1
+          kind: Package
+          name: cozystack.capi-provider-ipam-in-cluster
+          any: true
+        not: true
+
+  - it: refuses to ship capmox with its IPAM provider disabled
+    set:
+      bundles:
+        system:
+          enabled: true
+          variant: isp-full
+        iaas:
+          enabled: true
+        enabledPackages:
+          - cozystack.capi-provider-infra-proxmox
+        disabledPackages:
+          - cozystack.capi-provider-ipam-in-cluster
+    asserts:
+      - failedTemplate:
+          errorMessage: "cozystack.capi-provider-infra-proxmox requires cozystack.capi-provider-ipam-in-cluster, which is listed in bundles.disabledPackages: capmox allocates worker addresses from an InClusterIPPool and has no DHCP mode, so without the IPAM provider no ProxmoxCluster ever becomes Ready"