Release v0.33.2 - #1177

Reviewing files that changed from the base of the PR and between f628e7d and 986faf1.

• packages/apps/kubernetes/images/cluster-autoscaler.tag (1 hunks)
• packages/apps/kubernetes/images/kubevirt-cloud-provider.tag (1 hunks)
• packages/apps/kubernetes/images/kubevirt-csi-driver.tag (1 hunks)
• packages/core/installer/values.yaml (1 hunks)
• packages/core/testing/values.yaml (1 hunks)
• packages/extra/bootbox/images/matchbox.tag (1 hunks)
• packages/system/bucket/images/s3manager.tag (1 hunks)
• packages/system/cozystack-api/values.yaml (1 hunks)
• packages/system/cozystack-controller/values.yaml (1 hunks)
• packages/system/dashboard/charts/kubeapps/templates/dashboard/configmap.yaml (1 hunks)
• packages/system/dashboard/values.yaml (2 hunks)
• packages/system/kamaji/values.yaml (1 hunks)
• packages/system/kubeovn-webhook/values.yaml (1 hunks)
• packages/system/kubeovn/values.yaml (1 hunks)
• packages/system/kubevirt-csi-node/values.yaml (1 hunks)

• GitHub Check: pre-commit
• GitHub Check: Prepare environment

packages/system/kubeovn/values.yaml (1)

65-67: Confirm GHCR manifest availability for the updated digest

We attempted an unauthenticated HTTP check against the GHCR v2 API and received a 401 response, which means we need to authenticate before verifying the manifest. Please manually confirm that the new digest has been pushed to ghcr.io/cozystack/cozystack/kubeovn for all required architectures—otherwise you’ll hit ImagePullBackOff during rollout.

You can verify with an authenticated registry client, for example:

# Log in to GHCR (requires a valid GHCR token in $CR_PAT)
echo "$CR_PAT" | docker login ghcr.io -u <USERNAME> --password-stdin

# Inspect the manifest
docker manifest inspect ghcr.io/cozystack/cozystack/kubeovn@sha256:17b2286d619a0f8d8f0259dacc6b1fc0920ab6223b0b85e326c35f81b772fab6

Or with crane (after logging in):

crane auth login ghcr.io --username <USERNAME> --password-stdin < $CR_PAT
crane digest ghcr.io/cozystack/cozystack/kubeovn@sha256:17b2286d619a0f8d8f0259dacc6b1fc0920ab6223b0b85e326c35f81b772fab6

If the manifest is missing, push the updated image before rolling out.

packages/apps/kubernetes/images/cluster-autoscaler.tag (1)

1-1: Verify digest-to-tag correctness for 0.25.2

The tag was bumped to 0.25.2 but the digest is identical to the previous 0.25.1 update in earlier commits. Upstream typically publishes a new digest per tag; please confirm that
sha256:3a817043… is indeed the canonical digest for 0.25.2 and not left over from 0.25.1.

If it’s stale, regenerate the file with the correct digest to avoid pull-time supply-chain surprises.

packages/system/cozystack-api/values.yaml (1)

2-2: Image bump looks good

Version and digest move in lock-step from v0.33.1 → v0.33.2. No other value changes detected. ✅

packages/system/kamaji/values.yaml (1)

6-6: Kamaji image correctly updated

The tag and digest now reference v0.33.2; repository path and pull policy remain untouched. All good.

packages/system/kubeovn-webhook/values.yaml (1)

3-3: Webhook image bump acknowledged

Consistent shift to v0.33.2 with fresh digest. 👍

packages/apps/kubernetes/images/kubevirt-csi-driver.tag (1)

1-1: Digest reused; please double-check

Similar to the autoscaler file, the digest for 0.25.2 is unchanged from the prior 0.25.1.
Confirm that upstream intentionally re-tagged the same image, or update the digest if a new one exists.

packages/core/testing/values.yaml (1)

2-2: Digest verification requires authenticated registry access
Automated checks didn’t return a manifest digest—GHCR demands authentication for HEAD requests. Please manually verify that the digest in packages/core/testing/values.yaml matches the tag:

• Run locally after logging in to GHCR:

docker login ghcr.io
docker manifest inspect ghcr.io/cozystack/cozystack/e2e-sandbox:v0.33.2 \
  --verbose \
  | grep -Eo "sha256:[0-9a-f]{64}"

Confirm it equals
sha256:692a839c0c020d4d4dfb521ec7510eeec9218e235eb2bc90966904f2e639215a.

• Or with Crane (after crane auth login ghcr.io):

crane digest ghcr.io/cozystack/cozystack/e2e-sandbox:v0.33.2

Expect the same SHA256 digest.

A mismatched or stale digest will break reproducible builds—please double-check.

packages/extra/bootbox/images/matchbox.tag (1)

1-1: Verify Matchbox image digest

Ensure the PXE boot flow isn’t broken by confirming the Matchbox tag’s digest matches the expected value. You can verify this locally using one of the following approaches:

• Using crane (install via go install github.com/google/go-containerregistry/cmd/crane@latest):

  #!/usr/bin/env bash
  set -euo pipefail
  
  tag="ghcr.io/cozystack/cozystack/matchbox:v0.33.2"
  expected="sha256:42bda89832ec98b054c5a62e04d67977ae7ede8111fdc96cc32baedf2378f07c"
  actual=$(crane digest "$tag")
  
  if [[ "$actual" != "$expected" ]]; then
    echo "Digest mismatch: expected $expected, got $actual"
    exit 1
  fi

• Using curl & jq (if you don’t have crane installed):

  #!/usr/bin/env bash
  set -euo pipefail
  
  repo="cozystack/cozystack/matchbox"
  tag="v0.33.2"
  expected="sha256:42bda89832ec98b054c5a62e04d67977ae7ede8111fdc96cc32baedf2378f07c"
  manifest=$(curl -s -H "Accept: application/vnd.docker.distribution.manifest.v2+json" \
    "https://ghcr.io/v2/${repo}/manifests/${tag}")
  actual=$(echo "$manifest" | jq -r '.config.digest')
  
  if [[ "$actual" != "$expected" ]]; then
    echo "Digest mismatch: expected $expected, got $actual"
    exit 1
  fi

Please run one of these in your local environment and confirm the digest matches.

packages/apps/kubernetes/images/kubevirt-cloud-provider.tag (1)

1-1: Confirm provider image digest manually

Digest validation ensures the specified SHA matches the published image and prevents silent pull failures on downstream clusters.

Please verify that the digest for
ghcr.io/cozystack/cozystack/kubevirt-cloud-provider:0.25.2
matches
sha256:e522960064290747a67502d4e8927c591bdb290bad1f0bae88a02758ebfd380f

You can run, for example:

crane digest ghcr.io/cozystack/cozystack/kubevirt-cloud-provider:0.25.2

or

docker pull ghcr.io/cozystack/cozystack/kubevirt-cloud-provider:0.25.2
docker inspect --format='{{index .RepoDigests 0}}' ghcr.io/cozystack/cozystack/kubevirt-cloud-provider:0.25.2

Location:

• packages/apps/kubernetes/images/kubevirt-cloud-provider.tag:1

packages/system/kubevirt-csi-node/values.yaml (1)

3-3: Ensure all charts reference the same CSI driver version

0.25.2 is set here; double-check that every Helm chart or manifest (e.g. controller-side objects, RBAC) referencing kubevirt-csi-driver was bumped as well to avoid split-version rollouts.

packages/core/installer/values.yaml (1)

2-2: Image tag bump looks good.

v0.33.2 + digest pinning keeps the release reproducible and tamper-resistant.
No further issues spotted in this stanza.

packages/system/cozystack-controller/values.yaml (1)

2-5: Consistent version & digest update – all good.

Tag, digest and the explicit cozystackVersion field are all bumped to v0.33.2, keeping the controller in sync with the release.
Nothing else to flag.

packages/system/dashboard/values.yaml (1)

22-23: Dashboard images updated coherently.

Both dashboard and kubeapps-apis images now point to v0.33.2 with pinned digests – release alignment looks correct and no mis-matches detected.

Also applies to: 40-41