fix(backport): batch for release-1.7, 2026-11-12 by cozystack-ci[bot] · Pull Request #5290 · cozystack/cozystack

cozystack-ci · 2026-11-12T11:33:20Z

What this PR does

Backports to release-1.7 from main, picked by the rules of the backport policy in merge order. A merged pull request comes as its own commits, picked with git cherry-pick -x so each keeps its author, message and sign-offs, and a merge commit that carries the original's merge message with a Backported-from: trailer naming it; a squash-merged one comes as one pick. backport-batch verify checks that shape. A pick listed as changed differs from the commit it came from; git range-diff <merge>^1..<merge>^2 <batch merge>^1..<batch merge>^2 shows how. A conflict or a failing check here is a backport task.

#5284 fix(seaweedfs): bump the COSI driver to v0.4.0 for the lost-grant fix, 1 commit

Maintainer overrides

#5083 fix(workloadmonitor): stop doubling the bucket- prefix in bucket Workload names: backport/skip, left out
#4973 fix(kubernetes-nodes): refuse a partial resources spec on every pool: backport/skip, left out
#5180 fix(tests): keep two unit tests green after the release image restamp: backport/skip, left out

Skipped

Rule 1, already on release-1.7: 46
Rule 2, the title type is not fix or security, or the scope is deps: 31
Rule 3, a breaking change: 5
Rule 4, touches platform migrations, targetVersion or a CRD, or makes a sizeable API change: 2

Rule 1, already on `release-1.7`

#4815 fix(vm-disk): name the importer error in the disk's WorkloadsReady message, its 2 commits picked, the last in 432336387019
#4756 fix(backupstrategy-controller): run backup clients on a package-owned image, its 2 commits picked, the last in 4643366734f8
#4293 fix(fluxcd): keep Helm uninstall working during flux-plunger recovery, its 1 commit picked, the last in 021040795b22
#4791 fix(kubernetes): keep NFS publish from hanging on a dead server, its 1 commit picked, the last in fa88bd1c4902
#4830 fix(multus): drop the CPU limit and make resources configurable, its 2 commits picked, the last in 363c8426bab7
#4865 fix(kafka): pass the container limits to the Kafka JVMs, its 3 commits picked, the last in fc38a540c02f
#4866 fix(linstor): mark volumes restored from a snapshot DRBD-initialized, its 1 commit picked, the last in f9550b71cc24
#4867 fix(e2e): keep chainsaw asserts polling through transient API errors, its 1 commit picked, the last in df75adc11cfa
#4819 fix(seaweedfs): build SeaweedFS in-tree with a bounded S3 read-ahead, its 5 commits picked, the last in 7f4c3463d2a9
#3427 fix(backups): prepare standalone VMDisk restore targets and add VM backup/restore e2e round-trips, its 3 commits picked, the last in 4ac0cd581481
#4889 fix(monitoring): send alerts to every Alertmanager replica, its 1 commit picked, the last in 5033d53410ba
#4929 fix(backups): gate every default Strategy CR on its CRD, its 2 commits picked, the last in dee1eef5590b
#4914 fix(fluxcd): close the flux-plunger review follow-ups for the hook, drain and Warnings, its 7 commits picked, the last in a8e491646a06
#4888 fix(ci): dispatch frozen-line builds with GITHUB_TOKEN, its 1 commit picked, the last in bf81e2d9db22
#4939 fix(cluster-api): resync capi-operator every minute, its 1 commit picked, the last in cc8d6a4f05a0
#5027 fix(hack): keep the backup stack in the vminstance selective install, its 1 commit picked, the last in 8ba8386a2e5c
#4955 fix(vm-disk): let CDI adopt the PVC a Velero restore recreates, its 2 commits picked, the last in 691d7bce038e
#4985 fix(etcd): stop counting canceled watch streams as failed gRPC requests, its 1 commit picked, the last in 38e408917936
#5005 fix(tcp-balancer): cap HAProxy fds and threads by the pod's own limits, its 1 commit picked, the last in 7a3d0b0a5559
#5071 fix(marketplace): do not install a connected repository's components on connect, its 2 commits picked, the last in 25f8f11187b9
#5086 fix(tenant): stop the gateway release waiting on TenantGateway listeners and certificates, its 1 commit picked, the last in 18b22495038b
#5087 fix(controller): carry healthCheckExprs and waitStrategy to existing releases, its 1 commit picked, the last in d2a452e89067
#5088 fix(ingress-nginx): drop the admission-webhook policy a rebase brought back, its 1 commit picked, the last in cf00b41e0e9a
#5142 fix(release): keep release bodies within GitHub's size limit, its 1 commit picked, the last in c7405158634e
#4917 fix(kubernetes): run Proxmox CCM v0.16.1 and pin the Proxmox images by digest, its 2 commits picked, the last in 8ff6dcacd3b5
#4974 fix(kubernetes-nodes): plan autoscaler capacity on the cores the VM actually gets, its 1 commit picked, the last in d68a163c2d86
#4971 fix(e2e): keep the Proxmox tenant kubeconfig per run and remove it, its 2 commits picked, the last in 77227c55e9d6
#4970 fix(e2e): read the KubernetesNodes pool release in the HelmRelease guard, its 3 commits picked, the last in 6b17a76ef6cb
#4972 fix(e2e): validate the leak allowlist against every suite layout, its 3 commits picked, the last in 7ec550b7b81f
#5082 fix(marketplace): pin a tapped repository to a digest instead of a mutable tag, its 15 commits picked, the last in 9cff86f85124
#4004 fix(dashboard): link a tenant row to its detail page, its 2 commits picked, the last in bd5e0b5e88b3
#5212 fix(cilium): pass the CiliumNode list to jq on stdin in the IPAM hook, its 1 commit picked, the last in b28a2e228160
#5213 fix(kubernetes): move the OIDC users out of the bootstrap Job's script, its 1 commit picked, the last in 02dd8e5454f8
#5208 fix(clickhouse): restore the archive a Backup was taken as, its 3 commits picked, the last in 9ded5c5fc356
#5230 fix(backups): re-render the default backup objects when the S3 endpoint changes, its 8 commits picked, the last in 490eab5b9aba
#5133 fix(securitygroups): project a membership-only group to a policy Cilium accepts, its 1 commit picked, the last in b7c50a5e070f
#5091 fix(postgres): render the declared databases in a stable order, its 1 commit picked, the last in b658dffe7c31
#5123 fix(mariadb-operator): derive the cluster name from the platform domain, its 2 commits picked, the last in 17702dd57bab
#5151 fix(redis): run one Sentinel when Redis runs a single pod, its 5 commits picked, the last in 5524a41b8586
#5124 fix(lineage, kubernetes): resolve CAPK node VMs to their cluster, its 2 commits picked, the last in c90856088aff
#5184 fix(api): read pool usage under the quota key the controller counts, its 1 commit picked, the last in 18c17af8d50f
#5190 fix(platform): remove the dead registries value and patch-containerd Secret, its 2 commits picked, the last in 617f88943895
#5211 fix(postgres): fail a backup job as soon as its cnpg Backup fails, its 1 commit picked, the last in 6645e21b9e0a
#5155 fix(postgres): refuse system databases and never drop them, its 1 commit picked, the last in 6f1bb80f8004
#5207 fix(mariadb): fail backup and restore jobs whose operator Job failed, its 5 commits picked, the last in ef3de554b99f
#5024 fix(kubernetes, monitoring): send tenant cluster metrics to the tenant's vminsert, its 1 commit picked, the last in 423a75bb31db

Rule 2, the title type is not `fix` or `security`, or the scope is `deps`

#4845 docs(governance): welcome new contributors and link LF sanctions guidance, type docs
#4881 feat(bucket): add a ui flag to skip the s3manager web UI, type feat
#4899 chore: link the FOSSA license scan for CLOMonitor, type chore
#4898 feat(backups): back up Valkey with the Redis strategy, type feat
#4940 docs(release): add changelog for v1.6.5, type docs
#4861 feat(release): sign the release assets and attach a source SBOM, type feat
#3780 docs: move the operator guides out of docs/ to where readers find them, type docs
#4936 docs(release): check changelog claims against the code, type docs
#4959 docs(release): point changelog check B at the Talos installer profile, type docs
#3777 docs(agents): define where a new document belongs, type docs
#5025 test(harbor): pin the resources of the nginx proxy and the portal, type test
#5039 feat(keycloak): load additional CA files from Secret or ConfigMap keys, type feat
#4860 feat(kubernetes-nodes): trust a factory CA in the Proxmox template script, type feat
#5090 ci(e2e): end the Proxmox lane's SSH key with a newline, type ci
#4969 test(kubernetes): pin RetryOnFailure on the Proxmox csi release, type test
#5000 test(kubernetes): name the Proxmox fixture's node pool <cluster>-<pool>, type test
#5168 docs(agents): steer agents away from Helm lookup, type docs
#4997 feat(release): attach an SBOM to every release image, type feat
#3440 ci(api-review-gate): publish the gate as a commit status, type ci
#5034 docs: move the repo-only guides onto the website, type docs
#5215 feat(monitoring-agents): export PVC labels from kube-state-metrics, type feat
#5217 feat(monitoring-agents): keep application identity in container log streams, type feat
#5171 feat(api): expose HelmRelease failure state on Application status, type feat
#5237 feat(operator): let the platform source trust a private registry CA, type feat
#5106 feat(release): make backports automatic with backport-batch, type feat
#4983 feat(api): add the reservation evaluator for tenant quotas, type feat
#5264 feat(release): keep a line's backport record and reports across batch pull requests, type feat
#5260 ci(e2e): skip final cleanup on disposable PR runners, type ci
#5046 feat(backups): record the RDB snapshot location and size for Redis backups, type feat
#5214 feat(observability-proxy): serve tenant namespace logs through an authorizing proxy, type feat
#5282 test(release): isolate report deduplication from workflow attempts, type test

Rule 3, a breaking change

#4790 fix(platform)!: refuse a networking variant change on a live cluster, ! in the title
#4796 fix(vm-disk)!: refuse a golden-image clone CDI would leave unbound, ! in the title
#5085 fix(kubernetes, opensearch, foundationdb)!: restrict managed application images, ! in the title
#4818 fix(keycloak)!: make the KMS proxy keep its keys across restarts, ! in the title
#5167 fix(monitoring-agents)!: isolate merged log payload under log_processed, ! in the title

Rule 4, touches platform migrations, `targetVersion` or a CRD, or makes a sizeable API change

#4941 fix(backups): keep the backupstrategy-controller Helm release under the Secret size limit, a sizeable API change (breaking-change: [v1alpha1] spec.spec.template: field "metadata" was removed, and 5 more), a CRD
#5223 fix(backups): report sizeBytes for MariaDB and CNPG backup artifacts, a CRD

{"version":2,"line":"release-1.7","built":{"main":"76a34d3e53a14c39d8df63eec6271c2eaae5ffea","line":"3cd9d4c220b519972677c7ff756ae6c4db07ef4a","newer":"","policy":"76a34d3e53a14c39d8df63eec6271c2eaae5ffea","batch":"e27d6630a0008381f0bc105a87d117dfcc29680f","tool":"76a34d3e53a14c39d8df63eec6271c2eaae5ffea","run":"https://github.com/cozystack/cozystack/actions/runs/43209950053","at":"2026-11-12T11:33:16Z","options":{"noWorkflowFiles":true,"mode":"new"}},"report":"9ca0285a0bb30a09736f6a430878b3ce0d32a2811639861e80daa549f208d7b3","closing":null,"deferred":[],"dropped":[],"stale":[]}

{"format":1,"id":"9ca0285a0bb30a09736f6a430878b3ce0d32a2811639861e80daa549f208d7b3","line":"release-1.7","built":{"main":"76a34d3e53a14c39d8df63eec6271c2eaae5ffea","line":"3cd9d4c220b519972677c7ff756ae6c4db07ef4a","newer":"","policy":"76a34d3e53a14c39d8df63eec6271c2eaae5ffea","batch":"e27d6630a0008381f0bc105a87d117dfcc29680f","tool":"76a34d3e53a14c39d8df63eec6271c2eaae5ffea","run":"https://github.com/cozystack/cozystack/actions/runs/43209950053","at":"2026-11-12T11:33:16Z","options":{"noWorkflowFiles":true,"mode":"new"}},"overrides":{"backport/include":[],"backport/skip":[4973,5083,5180]},"primary":{"picked":[5284],"missing":[],"deferred":[],"parked":[],"skipped":{"on-line":[3427,4004,4293,4756,4791,4815,4819,4830,4865,4866,4867,4888,4889,4914,4917,4929,4939,4955,4970,4971,4972,4974,4985,5005,5024,5027,5071,5082,5086,5087,5088,5091,5123,5124,5133,5142,5151,5155,5184,5190,5207,5208,5211,5212,5213,5230],"before-start":[],"type":[3440,3777,3780,4845,4860,4861,4881,4898,4899,4936,4940,4959,4969,4983,4997,5000,5025,5034,5039,5046,5090,5106,5168,5171,5214,5215,5217,5237,5260,5264,5282],"breaking":[4790,4796,4818,5085,5167],"touches":[4941,5223],"newer":[],"skip-label":[4973,5083,5180],"dropped":[]}},"overlays":{"dropped":[],"stale":[],"changed":[]},"diag":{},"other":[]}

Screenshots

See the original pull requests.

Downstream repositories

Release note

fix(seaweedfs): bucket users granted together could get S3 keys that never work (403 InvalidAccessKeyId). COSI driver is bumped to v0.4.0, which writes each grant to per-identity IAM file.

seaweedfs-cosi-driver v0.3.1 grants access by rewriting the legacy /etc/iam/identity.json. Each S3 gateway migrates that file to per-identity files and renames it away whenever it changes, so a grant written while a gateway is migrating is lost: the BucketAccess reports accessGranted and its Secret is written, but every gateway rejects the key with InvalidAccessKeyId and never recovers. Users added to a Bucket in one change lose a key regularly. v0.4.0 also writes the per-identity file on grant. The rest of v0.4.0 does not reach the platform. The readwrite-governance-bypass access policy is opt-in and no BucketAccessClass uses it. The refusal to delete a bucket that still holds locked objects applies only to object-lock buckets, and their classes are Retain, so the sidecar never calls DriverDeleteBucket for them. Assisted-by: LLM Signed-off-by: Myasnikov Daniil <[email protected]> (cherry picked from commit 6a93765) Signed-off-by: cozystack-ci[bot] <274107086+cozystack-ci[bot]@users.noreply.github.com>

…#5284) ## What this PR does This PR bumps seaweedfs COSI driver to v0.4.0, because v0.3.1 can lose a grant for good: BucketAccess reports `accessGranted` and its Secret is written, but S3 gateways keep rejecting the key with `InvalidAccessKeyId`. Fixes #4912. Driver v0.3.1 grants access by rewriting legacy `/etc/iam/identity.json`, and every S3 gateway migrates this file to per-identity files and renames it away on each change, so grant written during migration is dropped. v0.4.0 also writes `/etc/iam/identities/<user>.json` on grant (seaweedfs/seaweedfs-cosi-driver#15). First version of this PR built the driver from that upstream commit, now upstream released v0.4.0 so it's just a tag bump. Rest of v0.4.0 doesn't reach the platform: - `readwrite-governance-bypass` access policy (seaweedfs/seaweedfs-cosi-driver#16) is opt-in, none of our BucketAccessClasses use it. - Bucket deletion is refused while objects hold an active lock (seaweedfs/seaweedfs-cosi-driver#18), only for object-lock buckets. All `-lock` BucketClasses are `Retain`, and sidecar calls DriverDeleteBucket only for `Delete`. - Filer errors (seaweedfs/seaweedfs-cosi-driver#20) are now matched by exact not-found message, I checked it against seaweedfs 4.45 filer and formats match. One behavior change: bucket deletion doesn't ignore errors of the recursive delete anymore, so sidecar retries instead of reporting success. How I tested (seaweedfs 4.45, two S3 gateways): Bucket with one user, then three more users added in one change, after a minute ListObjects with each user key, rejected key retried once more after 30s. Five runs for each driver, the fixed one is a build of `5efd120`, the commit v0.4.0 takes the grant fix from: | driver | keys rejected for good | | --- | --- | | v0.3.1 | 5 of 20 (4 runs out of 5 lost at least one) | | `5efd120` | 0 of 20 | Same failure broke v1.7.1-rc.1 e2e, RabbitMQ backup round-trip got `403 InvalidAccessKeyId` for freshly granted key: https://github.com/cozystack/cozystack/actions/runs/42980741995 Keys already lost on running clusters stay broken after upgrade. Workaround from #4912 still works: remove user from Bucket, wait until its BucketAccess is gone, add it back. ### Screenshots Not a UI change. ### Downstream repositories - [x] No downstream repository is affected by this change - [ ] [cozystack/website](https://github.com/cozystack/website) - follow-up: - [ ] [cozystack/terraform-provider-cozystack](https://github.com/cozystack/terraform-provider-cozystack) - follow-up: - [ ] [cozystack/ansible-cozystack](https://github.com/cozystack/ansible-cozystack) - follow-up: - [ ] [cozystack/ccp](https://github.com/cozystack/ccp) - follow-up: - [ ] [cozystack/talm](https://github.com/cozystack/talm) - follow-up: - [ ] [cozystack/cozyhr](https://github.com/cozystack/cozyhr) - follow-up: - [ ] [cozystack/cozy-proxy](https://github.com/cozystack/cozy-proxy) - follow-up: - [ ] [cozystack/cozystack-telemetry-server](https://github.com/cozystack/cozystack-telemetry-server) - follow-up: - [ ] [cozystack/external-apps-example](https://github.com/cozystack/external-apps-example) - follow-up: - [ ] [cozystack/examples](https://github.com/cozystack/examples) - follow-up: - [ ] [cozystack/community](https://github.com/cozystack/community) - follow-up: ### Release note ```release-note fix(seaweedfs): bucket users granted together could get S3 keys that never work (403 InvalidAccessKeyId). COSI driver is bumped to v0.4.0, which writes each grant to per-identity IAM file. ```   ## Summary by CodeRabbit * **Updates** * Updated the SeaweedFS COSI driver to version `v0.4.0`. * The updated driver writes IAM files per identity, helping preserve grants when identity files are updated.  Backported-from: 76a34d3

cozystack-ci · 2026-11-12T11:33:22Z

Backport batch report for release-1.7, 2026-11-12 (9ca0285a0bb3)

{"format":1,"id":"9ca0285a0bb30a09736f6a430878b3ce0d32a2811639861e80daa549f208d7b3","line":"release-1.7","built":{"main":"76a34d3e53a14c39d8df63eec6271c2eaae5ffea","line":"3cd9d4c220b519972677c7ff756ae6c4db07ef4a","newer":"","policy":"76a34d3e53a14c39d8df63eec6271c2eaae5ffea","batch":"e27d6630a0008381f0bc105a87d117dfcc29680f","tool":"76a34d3e53a14c39d8df63eec6271c2eaae5ffea","run":"https://github.com/cozystack/cozystack/actions/runs/43209950053","at":"2026-11-12T11:33:16Z","options":{"noWorkflowFiles":true,"mode":"new"}},"overrides":{"backport/include":[],"backport/skip":[4973,5083,5180]},"primary":{"picked":[5284],"missing":[],"deferred":[],"parked":[],"skipped":{"on-line":[3427,4004,4293,4756,4791,4815,4819,4830,4865,4866,4867,4888,4889,4914,4917,4929,4939,4955,4970,4971,4972,4974,4985,5005,5024,5027,5071,5082,5086,5087,5088,5091,5123,5124,5133,5142,5151,5155,5184,5190,5207,5208,5211,5212,5213,5230],"before-start":[],"type":[3440,3777,3780,4845,4860,4861,4881,4898,4899,4936,4940,4959,4969,4983,4997,5000,5025,5034,5039,5046,5090,5106,5168,5171,5214,5215,5217,5237,5260,5264,5282],"breaking":[4790,4796,4818,5085,5167],"touches":[4941,5223],"newer":[],"skip-label":[4973,5083,5180],"dropped":[]}},"overlays":{"dropped":[],"stale":[],"changed":[]},"diag":{},"other":[]}

coderabbitai · 2026-11-12T11:33:27Z

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

Source mode: Auto
Repository: cozystack/cozystack
Branch: release-1.7
File: .coderabbit.yaml
Commit: 3cd9d4c
Layers: Repository YAML
Review profile: CHILL
Plan: Advanced
Run ID: 46d689ff-068c-4fa4-90b6-0db2ca26f4ef

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

Trigger review

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

myasnikovdaniil and others added 2 commits November 12, 2026 11:33

github-actions Bot added area/release Issues or PRs related to release tooling (changelog, backport, release pipeline) kind/bug Categorizes issue or PR as related to a bug size/S This PR changes 10-29 lines, ignoring generated files labels Nov 12, 2026

myasnikovdaniil marked this pull request as ready for review November 12, 2026 11:51

myasnikovdaniil requested review from IvanHunters, Andrei Kvapil (kvaps), Aleksei Sviridkin (lexfrei), Timofei Larkin (lllamnyp), mattia-eleuteri, myasnikovdaniil and Kirill Ilin (sircthulhu) as code owners November 12, 2026 11:51

myasnikovdaniil approved these changes Nov 12, 2026

View reviewed changes

myasnikovdaniil merged commit 12705a1 into release-1.7 Nov 12, 2026
18 of 19 checks passed

myasnikovdaniil deleted the backport-batch/release-1.7-20261112 branch November 12, 2026 11:51

Navigation Menu

Repository navigation

fix(backport): batch for release-1.7, 2026-11-12 - #5290

fix(backport): batch for release-1.7, 2026-11-12#5290
myasnikovdaniil merged 2 commits into
release-1.7from
backport-batch/release-1.7-20261112

cozystack-ci Bot commented Nov 12, 2026

Uh oh!

cozystack-ci Bot commented Nov 12, 2026

Uh oh!

coderabbitai Bot commented Nov 12, 2026 •

edited

Loading

Review skipped

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

cozystack-ci Bot commented Nov 12, 2026

What this PR does

Maintainer overrides

Skipped

Screenshots

Downstream repositories

Release note

Uh oh!

cozystack-ci Bot commented Nov 12, 2026

Uh oh!

coderabbitai Bot commented Nov 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

coderabbitai Bot commented Nov 12, 2026 •

edited

Loading