Tracking: upstream MetalLB fixes filed during v0.16.0 bump (cozystack#2699) #2714

During the MetalLB v0.16.0 bump in #2699, several real upstream bugs surfaced in metallb/metallb and metallb/frr-k8s Helm charts and CRDs. All five were filed upstream as PRs; cozystack carries a corresponding workaround for one of them (the install-time nil pointer) in packages/system/metallb/values.yaml. This issue tracks landings so the workaround can be dropped on the next MetalLB chart bump.

Upstream PRs

• metallb/metallb#3054 — fix(api): correct LocalASN OpenAPI format to int64. BGPPeer.spec.localASN declared Maximum=4294967295 with no Format annotation, so the generated CRD claimed format: int32 (whose max is 2,147,483,647). Schema-only fix.
• metallb/metallb#3055 — fix(chart): emit prometheus.io/scheme=https across all annotation paths. v0.16.0 moved metrics to HTTPS-only on port 9120, but pod-level annotations, PodMonitor, and the annotation-only Service objects bundled with the ServiceMonitor still pointed at HTTP. Annotation-based Prometheus scrape fails with TLS handshake error.
• metallb/metallb#3057 — fix(chart): tighten speaker.bgpDebounceTimeout schema to minimum 1. The schema admitted 0, which the speaker binary rejects with os.Exit(1) (speaker/main.go:134). Aligns helm-time validation with the runtime contract.
• metallb/metallb#3058 — helm: fix frr-k8s subchart values to prevent nil pointer errors. Merged 2026-05-21 by upstream maintainer (fedepaol). The parent chart's frr-k8s.prometheus: placeholder block parsed as a null map, clobbering the subchart's prometheus defaults via Helm value deep-merge. Aborted helm install with a nil pointer at frr-k8s/templates/service-monitor.yaml. This is the root cause of the e2e failure on chore(metallb): bump to v0.16.1 and rotate host-network port denylist #2699 that the cozystack workaround addresses. Our own duplicate (#3059) was closed in favor of this one.
• metallb/frr-k8s#447 — fix(chart): correct values.schema.json structure and types. Four bugs in one file: trailing-colon typo on frrk8s.frr.resources; integer-only serviceMonitor.interval (Prometheus convention is a duration string); crds and frrk8s blocks misplaced under prometheus, where JSON Schema silently ignores them.

Cozystack-side workaround

packages/system/metallb/values.yaml pins:

metallb:
  frr-k8s:
    prometheus:
      serviceMonitor:
        enabled: false
      podMonitor:
        enabled: false

to sidestep the null-merge install-time crash that #3058 fixes upstream. Once a MetalLB chart release containing #3058 lands and packages/system/metallb consumes it, this override block can be removed from the cozystack values.yaml.

Definition of done

• All five upstream PRs are merged. (1 of 5 done: openbao: StatefulSet data PVC is orphaned after deletion #3058 merged 2026-05-21.)
• A MetalLB chart release containing openbao: StatefulSet data PVC is orphaned after deletion #3058 is available.
• A follow-up cozystack PR bumps the vendored metallb chart and removes the frr-k8s.prometheus override block from packages/system/metallb/values.yaml.