Release v0.33.0 - #1159
Conversation
Signed-off-by: cozystack-bot <217169706+cozystack-bot@users.noreply.github.com>
db22001 to
a9674d2
Compare
WalkthroughThis change updates various container image tags and digests across multiple YAML and tag files. The updates primarily involve version bumps for several components, including core, system, monitoring, and extra services, as well as updates to associated SHA256 digests where applicable. No logic, control flow, or public entity declarations were altered. Changes
Sequence Diagram(s)Possibly related PRs
Suggested labels
Suggested reviewers
Poem
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
packages/system/dashboard/charts/kubeapps/templates/dashboard/configmap.yaml (1)
78-80: Remember to bump Chart.yamlappVersionto keep Helm metadata consistent
config.jsonnow advertisesv0.33.0; ensureChart.yaml(and any.appVersioninvalues.yaml) reflects the same version so Helm UI doesn’t show mixed numbers.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (18)
packages/apps/clickhouse/images/clickhouse-backup.tag(1 hunks)packages/apps/http-cache/images/nginx-cache.tag(1 hunks)packages/apps/kubernetes/images/cluster-autoscaler.tag(1 hunks)packages/apps/kubernetes/images/kubevirt-cloud-provider.tag(1 hunks)packages/apps/kubernetes/images/kubevirt-csi-driver.tag(1 hunks)packages/apps/mysql/images/mariadb-backup.tag(1 hunks)packages/core/installer/values.yaml(1 hunks)packages/core/testing/values.yaml(1 hunks)packages/extra/bootbox/images/matchbox.tag(1 hunks)packages/extra/monitoring/images/grafana.tag(1 hunks)packages/system/bucket/images/s3manager.tag(1 hunks)packages/system/cozystack-api/values.yaml(1 hunks)packages/system/cozystack-controller/values.yaml(1 hunks)packages/system/dashboard/charts/kubeapps/templates/dashboard/configmap.yaml(1 hunks)packages/system/dashboard/values.yaml(2 hunks)packages/system/kamaji/values.yaml(1 hunks)packages/system/kubeovn-webhook/values.yaml(1 hunks)packages/system/kubeovn/values.yaml(1 hunks)
🧰 Additional context used
🧠 Learnings (8)
📓 Common learnings
Learnt from: NickVolynkin
PR: cozystack/cozystack#1117
File: packages/apps/mysql/Makefile:8-8
Timestamp: 2025-06-26T04:29:24.830Z
Learning: The cozystack project uses yq v4+ on their CI runner, so yq v4 syntax (-o json --indent 4) is compatible and version checks are not needed.
Learnt from: NickVolynkin
PR: cozystack/cozystack#1120
File: packages/apps/ferretdb/README.md:35-37
Timestamp: 2025-07-02T09:58:11.385Z
Learning: In the cozystack repository, the maintainer NickVolynkin prefers to keep realistic-looking example credentials in README documentation rather than using generic placeholders like <ACCESS_KEY>, even though they are just examples and not real secrets.
packages/apps/http-cache/images/nginx-cache.tag (1)
Learnt from: NickVolynkin
PR: cozystack/cozystack#1117
File: packages/apps/mysql/Makefile:8-8
Timestamp: 2025-06-26T04:29:24.830Z
Learning: The cozystack project uses yq v4+ on their CI runner, so yq v4 syntax (-o json --indent 4) is compatible and version checks are not needed.
packages/apps/kubernetes/images/cluster-autoscaler.tag (1)
Learnt from: NickVolynkin
PR: cozystack/cozystack#1117
File: packages/apps/mysql/Makefile:8-8
Timestamp: 2025-06-26T04:29:24.830Z
Learning: The cozystack project uses yq v4+ on their CI runner, so yq v4 syntax (-o json --indent 4) is compatible and version checks are not needed.
packages/system/cozystack-api/values.yaml (2)
Learnt from: NickVolynkin
PR: cozystack/cozystack#1117
File: packages/apps/mysql/Makefile:8-8
Timestamp: 2025-06-26T04:29:24.830Z
Learning: The cozystack project uses yq v4+ on their CI runner, so yq v4 syntax (-o json --indent 4) is compatible and version checks are not needed.
Learnt from: NickVolynkin
PR: cozystack/cozystack#1120
File: packages/apps/ferretdb/README.md:35-37
Timestamp: 2025-07-02T09:58:11.385Z
Learning: In the cozystack repository, the maintainer NickVolynkin prefers to keep realistic-looking example credentials in README documentation rather than using generic placeholders like <ACCESS_KEY>, even though they are just examples and not real secrets.
packages/core/testing/values.yaml (1)
Learnt from: NickVolynkin
PR: cozystack/cozystack#1117
File: packages/apps/mysql/Makefile:8-8
Timestamp: 2025-06-26T04:29:24.830Z
Learning: The cozystack project uses yq v4+ on their CI runner, so yq v4 syntax (-o json --indent 4) is compatible and version checks are not needed.
packages/core/installer/values.yaml (2)
Learnt from: NickVolynkin
PR: cozystack/cozystack#1117
File: packages/apps/mysql/Makefile:8-8
Timestamp: 2025-06-26T04:29:24.830Z
Learning: The cozystack project uses yq v4+ on their CI runner, so yq v4 syntax (-o json --indent 4) is compatible and version checks are not needed.
Learnt from: NickVolynkin
PR: cozystack/cozystack#1120
File: packages/apps/ferretdb/README.md:35-37
Timestamp: 2025-07-02T09:58:11.385Z
Learning: In the cozystack repository, the maintainer NickVolynkin prefers to keep realistic-looking example credentials in README documentation rather than using generic placeholders like <ACCESS_KEY>, even though they are just examples and not real secrets.
packages/system/cozystack-controller/values.yaml (2)
Learnt from: NickVolynkin
PR: cozystack/cozystack#1117
File: packages/apps/mysql/Makefile:8-8
Timestamp: 2025-06-26T04:29:24.830Z
Learning: The cozystack project uses yq v4+ on their CI runner, so yq v4 syntax (-o json --indent 4) is compatible and version checks are not needed.
Learnt from: NickVolynkin
PR: cozystack/cozystack#1120
File: packages/apps/ferretdb/README.md:35-37
Timestamp: 2025-07-02T09:58:11.385Z
Learning: In the cozystack repository, the maintainer NickVolynkin prefers to keep realistic-looking example credentials in README documentation rather than using generic placeholders like <ACCESS_KEY>, even though they are just examples and not real secrets.
packages/system/bucket/images/s3manager.tag (2)
Learnt from: NickVolynkin
PR: cozystack/cozystack#1117
File: packages/apps/mysql/Makefile:8-8
Timestamp: 2025-06-26T04:29:24.830Z
Learning: The cozystack project uses yq v4+ on their CI runner, so yq v4 syntax (-o json --indent 4) is compatible and version checks are not needed.
Learnt from: NickVolynkin
PR: cozystack/cozystack#1120
File: packages/apps/ferretdb/README.md:35-37
Timestamp: 2025-07-02T09:58:11.385Z
Learning: In the cozystack repository, the maintainer NickVolynkin prefers to keep realistic-looking example credentials in README documentation rather than using generic placeholders like <ACCESS_KEY>, even though they are just examples and not real secrets.
⏰ Context from checks skipped due to timeout of 90000ms (1)
- GitHub Check: Prepare environment
🔇 Additional comments (16)
packages/system/bucket/images/s3manager.tag (1)
1-1: Confirm digest originates from the signed v0.5.0 image buildOnly the SHA256 was updated while the semantic tag stayed at
v0.5.0.
Please double-check that:
- The pushed digest actually corresponds to the same released artefact (no code changes that would justify
v0.5.1).- The new digest has been signed / attested (cosign or equivalent) and the provenance record is uploaded, otherwise the supply-chain verification in CI will fail.
If both points are already covered, feel free to ignore.
packages/system/kubeovn/values.yaml (1)
67-67: Confirm digest correctness and existence in GHCROnly the SHA256 digest changed. Please double-check that
ghcr.io/cozystack/cozystack/kubeovn:v1.13.13@sha256:6315d118…has been pushed and is public before merging; otherwise Helm pulls will fail.packages/apps/clickhouse/images/clickhouse-backup.tag (1)
1-1: Digest unchanged—confirm this isn’t an accidental no-op upgradeThe tag was bumped from
0.10.1to0.11.0, yet the SHA256 digest is identical.
If upstream actually published different layers for0.11.0, pinning the old digest defeats the purpose of the upgrade. Please double-check thatsha256:3faf7a4…really corresponds to the new release and, if not, update the digest accordingly.packages/extra/monitoring/images/grafana.tag (1)
1-1: Manual verification required: digest check tool unavailable
We attempted to inspectghcr.io/cozystack/cozystack/grafana:1.12.0withskopeo, but the command isn’t installed in this environment. Please verify the SHA256 digest for the1.12.0image using a registry tool of your choice (e.g.skopeo inspect,crane digest,regctl digest) and update the digest in:
- packages/extra/monitoring/images/grafana.tag:1
if it differs from
sha256:c63978e1ed0304e8518b31ddee56c4e8115541b997d8efbe1c0a74da57140399.packages/apps/http-cache/images/nginx-cache.tag (1)
1-1: Verify pinned digest & downstream referencesThe automated manifest HEAD/GET calls did not return a
Docker-Content-Digestheader, so please manually ensure that the hard-pinned digest in
packages/apps/http-cache/images/nginx-cache.tagghcr.io/cozystack/cozystack/nginx-cache:0.6.0@sha256:b7633717cd7449c0042ae92d8ca9b36e4d69566561f5c7d44e21058e7d05c6d5matches the
0.6.0manifest in GHCR. Afterwards, any downstream manifests or Helm charts that deploynginx-cachemust be updated to this new digest in the same PR to prevent image-drift.• Confirm digest via the registry UI/API or by fetching the manifest payload and computing its sha256 sum.
• Bump all references (Helm charts, kustomize overlays, etc.) that pullnginx-cache:0.6.0@…to use the verified digest.packages/extra/bootbox/images/matchbox.tag (1)
1-1: Digest-pinned upgrade LGTMImage tag moved to
v0.33.0and is digest-pinned—keeps deployments reproducible. No further action.packages/core/testing/values.yaml (1)
2-2: Moved offlatest, nice!Switching the E2E image from a floating
latesttag to an explicitv0.33.0@sha256:…eliminates drift between CI runs. 👍packages/core/installer/values.yaml (1)
2-2: Action Required: Verify installer image digest availability
- File: packages/core/installer/values.yaml (line 2)
image: ghcr.io/cozystack/cozystack/installer:v0.33.0@sha256:6cdc5d9062b536929152214e8a6a6b8096b64a17592e04a3633f58d21ff43a63Please ensure this digest is valid and the image is reachable by running locally:
docker pull ghcr.io/cozystack/cozystack/installer@sha256:6cdc5d9062b536929152214e8a6a6b8096b64a17592e04a3633f58d21ff43a63If Docker isn’t available, you can alternatively verify via
crane digest,skopeo inspect, or the GitHub Container Registry HTTP API. Confirm the pull or digest check succeeds before merging.packages/system/kubeovn-webhook/values.yaml (1)
3-3: Webhook image bump acknowledgedNo issues spotted; digest pinning retained.
packages/system/kamaji/values.yaml (1)
6-6: Manual check required for Helm template renderingThe
kamaji.image.taginpackages/system/kamaji/values.yaml(line 6) now includes a digest (v0.33.0@sha256:…). The chart templates inpackages/system/kamaji/templates/concatenate the repository and tag with:, which will render as:ghcr.io/cozystack/cozystack/kamaji:v0.33.0@sha256:…Although Docker accepts this syntax, some Helm linters or private registries may mis-parse the second
:. Please run locally:helm template kamaji ./packages/system/kamaji \ --values ./packages/system/kamaji/values.yaml | rg 'image:' -nand confirm each container spec shows the full reference exactly once.
If you encounter parsing issues, consider moving the digest into a separateimage.digestfield instead of embedding it inimage.tag.packages/system/cozystack-api/values.yaml (1)
2-2: LGTM – version bump only.Tag + digest are bumped consistently to
v0.33.0. No other behavioural changes.packages/system/cozystack-controller/values.yaml (1)
2-6: Remember to update cluster-wide RBAC & CRDs if the controller introduces new APIs.The controller and the propagated
cozystackVersionare nowv0.33.0. If the 0.33 release adds/renames CRDs or requires extra permissions, ensure the corresponding manifests are shipped in the chart and migration docs are updated, otherwise upgrades may stall.packages/system/dashboard/values.yaml (1)
22-24: Consistent digest pinning appreciated – double-check that both images were pushed.Both
dashboardandkubeapps-apismove tov0.33.0and have digests pinned. Great for reproducibility; just verify that the digests correspond to the 0.33.0 tags you intend (CI occasionally lags on multi-arch pushes).Also applies to: 40-41
packages/apps/kubernetes/images/cluster-autoscaler.tag (1)
1-1: Manual Digest Verification RequiredOur automated header check returned no digest—GHCR often requires authentication to expose the
Docker-Content-Digest. Please confirm that the recorded digest (sha256:3a8170433e1632e5cc2b6d9db34d0605e8e6c63c158282c38450415e700e932e) truly matches the0.25.0tag. You can verify with one of the following approaches:
- Pull & inspect via Docker CLI:
docker pull ghcr.io/cozystack/cozystack/cluster-autoscaler:0.25.0 docker inspect --format='{{index .RepoDigests 0}}' ghcr.io/cozystack/cozystack/cluster-autoscaler:0.25.0- Fetch the manifest digest over HTTPS with a GHCR token:
export GHCR_TOKEN=<your_token> curl -fsI \ -H "Authorization: Bearer $GHCR_TOKEN" \ -H "Accept: application/vnd.oci.image.manifest.v1+json" \ https://ghcr.io/v2/cozystack/cozystack/cluster-autoscaler/manifests/0.25.0 \ | grep -i Docker-Content-DigestIf the values diverge, please update the
.tagfile to reflect the correct digest to preserve reproducible builds and accurate image scanning.packages/apps/kubernetes/images/kubevirt-csi-driver.tag (1)
1-1: LGTM – new tag & digest pair looks consistentTag updated to
0.25.0and a new digest accompanies it. No further issues spotted.packages/apps/kubernetes/images/kubevirt-cloud-provider.tag (1)
1-1: LGTM – version bump is soundThe tag/digest pair for
kubevirt-cloud-provideris updated coherently to0.25.0. Looks good.
| @@ -1 +1 @@ | |||
| ghcr.io/cozystack/cozystack/mariadb-backup:0.8.1@sha256:cfd1c37d8ad24e10681d82d6e6ce8a641b4602c1b0ffa8516ae15b4958bb12d4 | |||
| ghcr.io/cozystack/cozystack/mariadb-backup:0.9.0@sha256:cfd1c37d8ad24e10681d82d6e6ce8a641b4602c1b0ffa8516ae15b4958bb12d4 | |||
There was a problem hiding this comment.
💡 Verification agent
🧩 Analysis chain
Digest likely outdated – confirm it corresponds to tag 0.9.0
Bumping the tag from 0.8.1 to 0.9.0 while leaving the sha256 unchanged is unusual; image digests almost always change between releases.
If the digest is stale, downstream pulls will silently fetch the wrong (old) image, defeating the supply-chain-pinning we rely on.
Run the check below to compare the pinned digest with the one published in GHCR:
Dependencies: curl, jq and network access to ghcr.io.
If the digests differ, please update the file with the correct value.
🏁 Script executed:
#!/usr/bin/env bash
# Verify that the pinned digest matches the remote digest for the given tag.
set -euo pipefail
IMAGE_PATH="cozystack/cozystack/mariadb-backup"
TAG="0.9.0"
PINNED="cfd1c37d8ad24e10681d82d6e6ce8a641b4602c1b0ffa8516ae15b4958bb12d4"
# Obtain an anonymous pull token from GHCR
TOKEN=$(curl -s "https://ghcr.io/token?scope=repository:${IMAGE_PATH}:pull" | jq -r '.token')
REMOTE=$(curl -s -H "Authorization: Bearer ${TOKEN}" \
-H "Accept: application/vnd.oci.image.manifest.v1+json" \
"https://ghcr.io/v2/${IMAGE_PATH}/manifests/${TAG}" |
jq -r '.config.digest' | cut -d: -f2)
if [[ "${REMOTE}" == "${PINNED}" ]]; then
echo "✔ Pinned digest matches remote (${REMOTE})"
else
echo "❌ Digest mismatch: pinned=${PINNED}, remote=${REMOTE}"
exit 1
fiLength of output: 1251
Update the pinned digest for mariadb-backup:0.9.0
The digest for ghcr.io/cozystack/cozystack/mariadb-backup:0.9.0 has changed. Please update the SHA256 to match the remote manifest.
• File: packages/apps/mysql/images/mariadb-backup.tag
• Line: 1
- ghcr.io/cozystack/cozystack/mariadb-backup:0.9.0@sha256:cfd1c37d8ad24e10681d82d6e6ce8a641b4602c1b0ffa8516ae15b4958bb12d4
+ ghcr.io/cozystack/cozystack/mariadb-backup:0.9.0@sha256:318ef2b7b8465fc33258b7aca9a4210b34f9e9e2e2f3cf9276c1e39d32907840📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| ghcr.io/cozystack/cozystack/mariadb-backup:0.9.0@sha256:cfd1c37d8ad24e10681d82d6e6ce8a641b4602c1b0ffa8516ae15b4958bb12d4 | |
| ghcr.io/cozystack/cozystack/mariadb-backup:0.9.0@sha256:318ef2b7b8465fc33258b7aca9a4210b34f9e9e2e2f3cf9276c1e39d32907840 |
🤖 Prompt for AI Agents
In packages/apps/mysql/images/mariadb-backup.tag at line 1, update the SHA256
digest for the image tag ghcr.io/cozystack/cozystack/mariadb-backup:0.9.0 to the
new value matching the remote manifest. Replace the existing digest with the
updated one to ensure the image reference is current and correct.
This PR prepares the release
v0.33.0.Summary by CodeRabbit