feat(platform): add support for non-Talos Kubernetes deployments - #1939

packages/system/velero/charts/velero/values.yaml (1)

339-346: Avoid directly editing vendored upstream chart values.

Modifying kubectl.image.repository and kubectl.image.tag directly in the vendored chart (charts/velero/values.yaml) will be overwritten during chart re-vendoring and creates maintenance burden.

Override these values in the parent packages/system/velero/values.yaml instead:

velero:
  kubectl:
    image:
      repository: alpine/k8s
      tag: "1.35.0"

As per coding guidelines: "Do NOT directly edit upstream Helm charts in vendored charts directory; use proper chart vendoring mechanisms."

packages/core/installer/templates/cozystack-operator-generic.yaml (1)

1-90: Consider adding nodeSelector for control-plane scheduling.

The Talos variant relies on hostNetwork: true to access localhost:7445 (KubePrism), which works because any node can reach its local API proxy. For the generic variant, if KUBERNETES_SERVICE_HOST points to a specific control-plane IP, scheduling to worker nodes could cause connectivity issues depending on network topology.

Consider whether this deployment should include a nodeSelector to schedule on control-plane nodes, or document that the ConfigMap should contain a universally reachable API server address (e.g., load balancer VIP).

packages/core/installer/templates/cozystack-operator-hosted.yaml (1)

68-77: Consider dnsPolicy: ClusterFirstWithHostNet when using hostNetwork.

With hostNetwork: true, pods inherit host DNS settings; if the operator relies on Kubernetes service DNS, resolution can fail. Add an explicit dnsPolicy or document the reliance on host DNS.

➕ Add ClusterFirstWithHostNet

       hostNetwork: true
+      dnsPolicy: ClusterFirstWithHostNet

hack/e2e-prepare-cluster.bats (1)

139-160: Consider removing or documenting the commented-out mirror endpoints.

Large blocks of commented-out configuration can become stale and confusing over time. If these alternative nexus mirrors are environment-specific options, consider either:

1. Removing them entirely if no longer needed.
2. Moving them to a separate example/documentation file if they're useful for specific deployment scenarios.

api/backups/v1alpha1/plan_types.go (1)

68-74: Consider validating BackupClassName is non-empty.

This avoids resolving a blank class name at runtime.

Suggested validation

 	// BackupClassName references a BackupClass that contains strategy and storage configuration.
 	// The BackupClass will be resolved to determine the appropriate strategy and storage
 	// based on the ApplicationRef.
+	// +kubebuilder:validation:MinLength=1
 	BackupClassName string `json:"backupClassName"`

internal/controller/dashboard/factory.go (1)

177-218: Deduplicate the Resource Quotas block.

The Info/Tenant branches are identical; consider merging them to reduce repetition.

♻️ Optional refactor

-	if kind == "Info" {
+	if kind == "Info" || kind == "Tenant" {
 		rightColStack = append(rightColStack,
 			antdFlexVertical("resource-quotas-block", 4, []any{
 				antdText("resource-quotas-label", true, "Resource Quotas", map[string]any{
 					"fontSize":     float64(20),
 					"marginBottom": float64(12),
 				}),
 				map[string]any{
 					"type": "EnrichedTable",
 					"data": map[string]any{
 						"id":                   "resource-quotas-table",
 						"baseprefix":           "/openapi-ui",
 						"clusterNamePartOfUrl": "{2}",
 						"customizationId":      "factory-resource-quotas",
 						"fetchUrl":             "/api/clusters/{2}/k8s/api/v1/namespaces/{3}/resourcequotas",
 						"pathToItems":          []any{`items`},
 					},
 				},
 			}),
 		)
 	}
-	if kind == "Tenant" {
-		rightColStack = append(rightColStack,
-			antdFlexVertical("resource-quotas-block", 4, []any{
-				antdText("resource-quotas-label", true, "Resource Quotas", map[string]any{
-					"fontSize":     float64(20),
-					"marginBottom": float64(12),
-				}),
-				map[string]any{
-					"type": "EnrichedTable",
-					"data": map[string]any{
-						"id":                   "resource-quotas-table",
-						"baseprefix":           "/openapi-ui",
-						"clusterNamePartOfUrl": "{2}",
-						"customizationId":      "factory-resource-quotas",
-						"fetchUrl":             "/api/clusters/{2}/k8s/api/v1/namespaces/{3}/resourcequotas",
-						"pathToItems":          []any{`items`},
-					},
-				},
-			}),
-		)
-	}

.github/workflows/pull-requests.yaml (2)

263-293: Consider quoting shell variables and using find for robustness.

Static analysis flags potential issues with unquoted variables and the ls | xargs pattern.

🔧 Proposed shell script improvements

-          for app in $(ls hack/e2e-apps/*.bats | xargs -n1 basename | cut -d. -f1); do
+          for app in $(find hack/e2e-apps -maxdepth 1 -name '*.bats' -exec basename {} .bats \;); do
             echo "::group::Testing $app"
             attempt=0
             success=false
             until [ $attempt -ge 3 ]; do
-              if make -C packages/core/testing SANDBOX_NAME=$SANDBOX_NAME test-apps-$app; then
+              if make -C packages/core/testing SANDBOX_NAME="$SANDBOX_NAME" test-apps-"$app"; then
                 success=true
                 break
               fi

---

295-329: Consider quoting SANDBOX_NAME in cleanup steps.

The SANDBOX_NAME variable should be quoted to prevent word splitting issues if it ever contains spaces.

🔧 Proposed fix

       - name: Collect report
         if: always()
         run: |
-          cd /tmp/$SANDBOX_NAME
-          make -C packages/core/testing SANDBOX_NAME=$SANDBOX_NAME collect-report || true
+          cd /tmp/"$SANDBOX_NAME"
+          make -C packages/core/testing SANDBOX_NAME="$SANDBOX_NAME" collect-report || true

Apply similar quoting to other steps using $SANDBOX_NAME.

internal/backupcontroller/backupclass_resolver.go (1)

58-69: Avoid returning a shared Parameters map.
strategy.Parameters is returned directly; downstream mutation would modify the cached object. Consider copying the map before returning.

🔧 Suggested defensive copy

-		if strategyAPIGroup == appAPIGroup && strategy.Application.Kind == applicationRef.Kind {
-			return &ResolvedBackupConfig{
-				StrategyRef: strategy.StrategyRef,
-				Parameters:  strategy.Parameters,
-			}, nil
-		}
+		if strategyAPIGroup == appAPIGroup && strategy.Application.Kind == applicationRef.Kind {
+			params := map[string]string{}
+			for k, v := range strategy.Parameters {
+				params[k] = v
+			}
+			return &ResolvedBackupConfig{
+				StrategyRef: strategy.StrategyRef,
+				Parameters:  params,
+			}, nil
+		}

internal/backupcontroller/velerostrategy_controller.go (1)

61-61: Consider adding nil guard for resolved parameter.

While the calling code should guarantee resolved is non-nil after successful BackupClass resolution, a defensive nil check would prevent unexpected panics if the calling contract changes.

🛡️ Optional defensive check

 func (r *BackupJobReconciler) reconcileVelero(ctx context.Context, j *backupsv1alpha1.BackupJob, resolved *ResolvedBackupConfig) (ctrl.Result, error) {
 	logger := getLogger(ctx)
+	if resolved == nil {
+		return r.markBackupJobFailed(ctx, j, "resolved backup config is nil")
+	}
 	logger.Debug("reconciling Velero strategy", "backupjob", j.Name, "phase", j.Status.Phase)