feat(dashboard): replace UI with new cozystack-ui build - #2507
Conversation
Replace old openapi-ui with new cozystack-ui that proxies API requests through BFF. Changes: - New UI image: 999669/cozystack-ui:latest@sha256:74e39ad4 - BFF container: kept unchanged for K8s API authentication - New UI includes TypeScript fixes and improved backup pages - nginx configured to proxy /api and /apis to localhost:64231 (BFF) Signed-off-by: IvanHunters <xorokhotnikov@gmail.com>
- Update openapiUI image to amd64 build (sha256:9d8fc5c1...) - Remove old openapi-ui and openapi-ui-k8s-bff build targets from Makefile - Remove old UI Dockerfiles and related files - Add RBAC permissions for cozystack.io/applicationdefinitions to fix 403 errors The new cozystack-ui requires read access to applicationdefinitions API group for marketplace and application catalog functionality. Signed-off-by: IvanHunters <xorokhotnikov@gmail.com>
Update to new image digest with dynamic WebSocket URL fix for VNC connections. VNC now uses window.location instead of hardcoded localhost:8001. Image: 999669/cozystack-ui:latest@sha256:ea4e832c2... Signed-off-by: IvanHunters <xorokhotnikov@gmail.com>
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughReplaces the OpenAPI UI/nginx/web stack with a single console deployment: Makefile now builds a pinned Changes
Sequence Diagram(s)sequenceDiagram
participant Dev as Developer/CI
participant Git as Git (CONSOLE_REPO)
participant Builder as Builder (make)
participant Registry as Image Registry
participant Values as Helm values.yaml
participant K8s as Kubernetes (helm)
Dev->>Builder: run `make image` (image-console)
Builder->>Git: git clone CONSOLE_REPO@CONSOLE_REF
Builder->>Builder: build image from Containerfile (cozystack-ui)
Builder->>Registry: push image & obtain digest
Builder->>Values: write image digest to `Values.console.image`
Dev->>K8s: helm upgrade/install using updated values
K8s->>K8s: deploy `cozy-dashboard-console` Deployment with new image
Estimated code review effort🎯 4 (Complex) | ⏱️ ~45 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
The cozy-installer chart declares Namespace cozy-system itself (with helm.sh/resource-policy: keep). Combining that with --create-namespace makes Helm v3 pre-create the namespace via plain kubectl-create (without helm annotations); the subsequent chart apply then fails with 'namespaces cozy-system already exists'. The 3x retry on Install Cozystack was hiding this. First attempt failed, second saw 'release exists' and treated it as upgrade. Reproducible across PRs (PR #2507 E2E hit the same first-attempt failure today and recovered on retry). Surfaced cleanly after dropping the retry on this step. Drop --create-namespace; let the chart manage its own namespace. Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
- Add RBAC permissions for VNC console access to virtual machines - Update cozystack-ui image to latest version with VNC fixes Signed-off-by: IvanHunters <xorokhotnikov@gmail.com>
Remove old openapi-ui implementation and adopt new React-based console: **Removed:** - images/openapi-ui/ - old PRO-Robotech based UI - images/openapi-ui-k8s-bff/ - unused backend-for-frontend - templates/nginx.yaml - separate nginx proxy (replaced by built-in nginx) - templates/configmap.yaml - old UI configuration **Changes:** - Rename web → console throughout all manifests - Rename incloud-web-* → cozy-dashboard-* for all resources - Remove all environment variables (new UI requires no configuration) - Update gatekeeper upstream to point directly to console service - Simplify Makefile (only token-proxy image build remains) - Update values.yaml: openapiUI → console **Architecture changes:** Before: gatekeeper → nginx → web (openapi-ui) After: gatekeeper → console (React SPA with built-in nginx) The new console includes nginx that proxies /api and /apis to K8s API, eliminating the need for a separate nginx deployment. Authentication flow remains unchanged - gatekeeper adds Authorization header which is passed through to K8s API. Breaking change: Resource names changed from incloud-web-* to cozy-dashboard-*. Existing deployments will need migration. Signed-off-by: IvanHunters <xorokhotnikov@gmail.com>
Add Makefile target to build console image from external repository: - Clone cozystack-ui repository (configurable via CONSOLE_REPO/CONSOLE_REF) - Build multi-arch image (amd64, arm64) - Push to registry and update values.yaml with digest - Clean up temporary directory after build This enables automated console image builds as part of the dashboard release process, similar to how token-proxy is built. Signed-off-by: IvanHunters <xorokhotnikov@gmail.com>
- Add --file flag to specify Containerfile path in docker buildx - Build console image from cozystack-ui feat/ui-overhaul branch - Update console image with VNC fix (includes /k8s proxy location) New console image includes nginx /k8s location for VNC WebSocket routing to KubeVirt VMI subresources. Signed-off-by: IvanHunters <xorokhotnikov@gmail.com>
- Pin CONSOLE_REF to a specific commit hash for reproducible builds - Fix git clone to support fetching by commit hash (not branch) - Pass COZYSTACK_VERSION as build arg for version display in UI Signed-off-by: IvanHunters <ivan.okhotnikov@aenix.io>
- Rename ClusterRoleBinding and update ServiceAccount references - Update FlowSchema to use new cozy-dashboard-console service account - Add core.cozystack.io permissions for tenant resources Signed-off-by: IvanHunters <ivan.okhotnikov@aenix.io>
Containerfile expects ARG APP_VERSION, not COZYSTACK_VERSION Signed-off-by: IvanHunters <ivan.okhotnikov@aenix.io>
Signed-off-by: IvanHunters <ivan.okhotnikov@aenix.io>
Summary of ChangesHello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request introduces a significant upgrade to the dashboard UI by integrating a new Highlights
🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console. Ignored Files
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on Gemini (@gemini-code-assist) comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here. Footnotes
|
Default docker driver does not support multi-platform builds. All other packages in make build use linux/amd64 only. Signed-off-by: IvanHunters <ivan.okhotnikov@aenix.io>
There was a problem hiding this comment.
Code Review
This pull request refactors the dashboard by replacing the legacy openapi-ui components with a new unified cozystack-ui console. The changes involve significant updates to the Makefile for image building, consolidation of Kubernetes manifests, and removal of obsolete Nginx configurations. Review feedback identifies high-severity security risks where sensitive resources like tenant secrets and VM VNC consoles are exposed to all authenticated users via broad RBAC permissions. Furthermore, the update violates style guidelines by using a personal image registry and manually defining image digests in the values file.
| - apiGroups: | ||
| - core.cozystack.io | ||
| resources: | ||
| - tenantmodules | ||
| - tenantnamespaces | ||
| - tenantsecrets | ||
| verbs: | ||
| - get | ||
| - list | ||
| - watch |
There was a problem hiding this comment.
Granting get, list, and watch permissions on tenantsecrets to all authenticated users (system:authenticated) is a significant security risk. In a multi-tenant PaaS, this allows any user with cluster access to discover and potentially inspect resources belonging to other tenants. These permissions should be restricted to administrative users or handled via more granular role bindings that respect tenant boundaries.
References
- Avoid overly broad RBAC permissions that expose sensitive resources like secrets to all authenticated users.
| - apiGroups: | ||
| - subresources.kubevirt.io | ||
| resources: | ||
| - virtualmachineinstances/vnc | ||
| verbs: | ||
| - get |
There was a problem hiding this comment.
Granting virtualmachineinstances/vnc access to system:authenticated allows any authenticated user in the cluster to potentially connect to the VNC console of any virtual machine. This permission should be restricted to the owners of the respective VMs or specific namespaces to prevent unauthorized access to VM consoles.
| openapiUIK8sBff: | ||
| image: ghcr.io/cozystack/cozystack/openapi-ui-k8s-bff:v1.3.0@sha256:1b3ea6d4c7dbbe6a8def3b2807fffdfab2ac4afc39d7a846e57dd491fa168f92 | ||
| console: | ||
| image: 999669/cozystack-ui:latest@sha256:c5b0dcfa241603763150188150d56ab58fba1ea820bfdac92c601199057bf9a2 |
There was a problem hiding this comment.
The image registry 999669 appears to be a personal account. Please use the official project registry (e.g., ghcr.io/cozystack/cozystack/cozystack-ui). Additionally, per the repository style guide (line 31), image digest values in values.yaml should be set by CI rather than manually updated in the pull request.
References
- Image digest values in values.yaml should be set by CI, not by humans. (link)
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (1)
packages/system/dashboard/Makefile (1)
12-32: Consider splittingimage-consoleinto smaller helper targets.The target is doing clone/build/update/cleanup in one block; breaking it up will satisfy checkmake and make failures easier to isolate.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@packages/system/dashboard/Makefile` around lines 12 - 32, The single large image-console target should be split into smaller phony helper targets to isolate clone, build, update-values, and cleanup steps; create targets like clone-console (runs git clone/fetch/checkout using CONSOLE_REPO and CONSOLE_REF into .tmp-cozystack-ui), build-console (invokes docker buildx with BUILDER, REGISTRY, TAG, COZYSTACK_VERSION, PUSH, LOAD and writes images/console.json), update-values-console (reads images/console.json to set IMAGE and updates values.yaml), and clean-console (removes .tmp-cozystack-ui and images/console.json), then make image-console depend on them in order so failures are isolated and checkmake passes; also declare .PHONY for these helper targets and preserve the same unique filenames (.tmp-cozystack-ui, images/console.json, values.yaml) and build args to avoid changing behavior.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@packages/system/dashboard/Makefile`:
- Line 7: Add a .PHONY declaration for the Makefile targets to ensure they
always run: declare image and its subtargets (image-console and
image-token-proxy) as phony targets so a file or directory named "image" won't
short-circuit execution; update the Makefile to include a .PHONY line listing
image, image-console, and image-token-proxy.
In `@packages/system/dashboard/templates/rbac.yaml`:
- Around line 15-24: The ClusterRole cozystack-dashboard-readonly currently
grants get/list/watch on tenantsecrets and is bound to system:authenticated,
which is overly broad; remove tenantsecrets from the ClusterRole (or remove the
ClusterRole binding to system:authenticated) and instead create a
namespace-scoped Role that grants get/list/watch on tenantsecrets and bind that
Role to the dashboard ServiceAccount (the same SA used by the dashboard
controller in internal/controller/dashboard/factory.go), or alternatively
restrict the existing binding to only that ServiceAccount rather than
system:authenticated.
---
Nitpick comments:
In `@packages/system/dashboard/Makefile`:
- Around line 12-32: The single large image-console target should be split into
smaller phony helper targets to isolate clone, build, update-values, and cleanup
steps; create targets like clone-console (runs git clone/fetch/checkout using
CONSOLE_REPO and CONSOLE_REF into .tmp-cozystack-ui), build-console (invokes
docker buildx with BUILDER, REGISTRY, TAG, COZYSTACK_VERSION, PUSH, LOAD and
writes images/console.json), update-values-console (reads images/console.json to
set IMAGE and updates values.yaml), and clean-console (removes .tmp-cozystack-ui
and images/console.json), then make image-console depend on them in order so
failures are isolated and checkmake passes; also declare .PHONY for these helper
targets and preserve the same unique filenames (.tmp-cozystack-ui,
images/console.json, values.yaml) and build args to avoid changing behavior.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: a752d515-a3cc-4e1b-b0e9-5a3212fa66ce
📒 Files selected for processing (21)
packages/system/dashboard/.gitignorepackages/system/dashboard/Makefilepackages/system/dashboard/images/openapi-ui-k8s-bff/Dockerfilepackages/system/dashboard/images/openapi-ui/Dockerfilepackages/system/dashboard/images/openapi-ui/openapi-k8s-toolkit/patches/flatmap-unresolved-placeholder.diffpackages/system/dashboard/images/openapi-ui/openapi-k8s-toolkit/patches/formlistinput-allow-empty.diffpackages/system/dashboard/images/openapi-ui/openapi-k8s-toolkit/patches/secret-copy-preserve-newlines.diffpackages/system/dashboard/images/openapi-ui/openapi-k8s-toolkit/patches/tenantmodules.diffpackages/system/dashboard/templates/clusterrolebinding-cluster-view.yamlpackages/system/dashboard/templates/configmap.yamlpackages/system/dashboard/templates/console-sa.yamlpackages/system/dashboard/templates/console-svc.yamlpackages/system/dashboard/templates/console.yamlpackages/system/dashboard/templates/flowschema.yamlpackages/system/dashboard/templates/gatekeeper.yamlpackages/system/dashboard/templates/nginx-config.yamlpackages/system/dashboard/templates/rbac.yamlpackages/system/dashboard/templates/web-sa.yamlpackages/system/dashboard/templates/web-svc.yamlpackages/system/dashboard/templates/web.yamlpackages/system/dashboard/values.yaml
💤 Files with no reviewable changes (11)
- packages/system/dashboard/images/openapi-ui-k8s-bff/Dockerfile
- packages/system/dashboard/templates/web-sa.yaml
- packages/system/dashboard/images/openapi-ui/openapi-k8s-toolkit/patches/flatmap-unresolved-placeholder.diff
- packages/system/dashboard/templates/web-svc.yaml
- packages/system/dashboard/templates/nginx-config.yaml
- packages/system/dashboard/images/openapi-ui/Dockerfile
- packages/system/dashboard/templates/web.yaml
- packages/system/dashboard/images/openapi-ui/openapi-k8s-toolkit/patches/secret-copy-preserve-newlines.diff
- packages/system/dashboard/images/openapi-ui/openapi-k8s-toolkit/patches/formlistinput-allow-empty.diff
- packages/system/dashboard/templates/configmap.yaml
- packages/system/dashboard/images/openapi-ui/openapi-k8s-toolkit/patches/tenantmodules.diff
| - apiGroups: | ||
| - core.cozystack.io | ||
| resources: | ||
| - tenantmodules | ||
| - tenantnamespaces | ||
| - tenantsecrets | ||
| verbs: | ||
| - get | ||
| - list | ||
| - watch |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Verify whether tenantsecrets is broadly exposed and whether it's actually required by dashboard paths.
set -euo pipefail
echo "== RBAC exposure =="
rg -n -C3 --iglob '*rbac*.yaml' 'cozystack-dashboard-readonly|system:authenticated|tenantsecrets'
echo
echo "== CRD definition hints for tenantsecrets =="
rg -n -C4 --iglob '*.{yaml,yml}' 'name:\s*tenantsecrets|tenantsecrets\.core\.cozystack\.io|kind:\s*CustomResourceDefinition'
echo
echo "== Repo usages of tenantsecrets =="
rg -n -C2 --iglob '*.{yaml,yml,go,ts,tsx,js}' '\btenantsecrets\b'Repository: cozystack/cozystack
Length of output: 50376
🏁 Script executed:
# More targeted searches
echo "=== Looking for tenantsecrets API group definition ==="
rg -n 'tenantsecrets\.core\.cozystack\.io' --max-count=20
echo
echo "=== Search for tenantsecrets in core.cozystack.io context ==="
rg -n -B2 -A2 'core\.cozystack\.io' --iglob '*.yaml' | grep -A5 -B5 tenantsecrets || echo "No context found"
echo
echo "=== Dashboard-specific code references to tenantsecrets ==="
fd -t f --iglob '*dashboard*' . | xargs rg -l 'tenantsecrets' 2>/dev/null || echo "No dashboard files reference tenantsecrets"
echo
echo "=== Check for cozystack-api CRD definitions ==="
fd -t f -path '*/cozystack-api/*' --iglob '*.yaml' | head -20
echo
echo "=== Search for tenantsecrets in cozystack-api or core APIs ==="
rg -n 'tenantsecrets' packages/system/cozystack-api/ 2>/dev/null | head -30 || echo "No tenantsecrets found in cozystack-api"Repository: cozystack/cozystack
Length of output: 1075
🏁 Script executed:
echo "=== Registry definition for tenantsecrets ==="
cat pkg/registry/core/tenantsecret/rest.go | head -80
echo
echo "=== Dashboard code usage of tenantsecrets ==="
rg -n 'tenantsecrets' internal/controller/dashboard/ -A2 -B2 | head -60
echo
echo "=== APIServer definition of tenantsecrets ==="
rg -n -A5 -B5 'tenantsecrets' pkg/apiserver/apiserver.go | head -80
echo
echo "=== Check cozystack-basics RBAC to see if tenantsecrets pattern exists elsewhere ==="
rg -n -A3 -B3 'tenantsecrets' packages/system/cozystack-basics/templates/clusterroles.yamlRepository: cozystack/cozystack
Length of output: 5842
Exposing tenantsecrets to all authenticated users weakens least-privilege.
The cozystack-dashboard-readonly ClusterRole grants get, list, and watch on tenantsecrets (line 20), which is bound to system:authenticated (line 75). Since tenantsecrets is a view over Kubernetes Secrets with sensitive data, this grants all authenticated cluster users read access to all tenant secrets cluster-wide.
While the dashboard legitimately uses tenantsecrets (via namespace-scoped API paths in internal/controller/dashboard/factory.go), the ClusterRole permission is broader than necessary. Consider restricting this to a Role bound to the dashboard's ServiceAccount, or limiting via RoleBindings in specific namespaces.
🔧 Suggested minimal hardening
- apiGroups:
- core.cozystack.io
resources:
- tenantmodules
- tenantnamespaces
- - tenantsecrets
verbs:
- get
- list
- watchAlternatively, if the dashboard must access tenantsecrets, create a separate Role (not ClusterRole) bound to the dashboard ServiceAccount.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@packages/system/dashboard/templates/rbac.yaml` around lines 15 - 24, The
ClusterRole cozystack-dashboard-readonly currently grants get/list/watch on
tenantsecrets and is bound to system:authenticated, which is overly broad;
remove tenantsecrets from the ClusterRole (or remove the ClusterRole binding to
system:authenticated) and instead create a namespace-scoped Role that grants
get/list/watch on tenantsecrets and bind that Role to the dashboard
ServiceAccount (the same SA used by the dashboard controller in
internal/controller/dashboard/factory.go), or alternatively restrict the
existing binding to only that ServiceAccount rather than system:authenticated.
There was a problem hiding this comment.
NOT LGTM — B4 and the legacy /openapi-ui redirect were both fixed in the previous round; the only remaining blocker is B2 (personal Docker Hub registry image in values.yaml). The latest commit 6fe9dcc reshapes the Makefile clone step (git clone with branch instead of fetch + raw-SHA checkout) but doesn't touch values.yaml.
Business context: Replace the old openapi-ui + BFF dashboard architecture with the new cozystack-ui console that talks to the Kubernetes API directly.
Resolved earlier rounds
- B1 (cross-tenant RBAC escalation) — fixed in caaf4f9.
- B3 (branding) — fixed in fd25969/d2dd687a/89b54349 via runtime config.json + adoption hook.
- B4 (Makefile values.yaml write race) — fixed in ec0e6d6 with
.NOTPARALLEL: image. - A1 (stale
incloud-web-web-user-editname) — renamed. - Non-blocking #1 (
/openapi-uiredirect) — fixed in 8c80c4d with nginx server-snippet.
Blocker still open
B2: chart default image still points at a personal Docker Hub account
File: packages/system/dashboard/values.yaml:2
Issue: console.image: 999669/cozystack-ui:latest@sha256:c5b0dcfa... is unchanged across every iteration of this PR. The 6fe9dcc build-helper refactor doesn't touch values.yaml.
Evidence: The Makefile target image-console (Makefile:32-33) writes $(REGISTRY)/cozystack-ui:...@sha256:<digest> into values.yaml after every official build; $(REGISTRY) resolves to ghcr.io/cozystack/cozystack for releases. The current 999669/... value is a manual one-off-build artifact carried across rounds.
Fix: Run make image-console against the official registry (make image-console PUSH=true REGISTRY=ghcr.io/cozystack/cozystack) and commit the regenerated values.yaml — single mechanical step.
| - apiGroups: | ||
| - subresources.kubevirt.io | ||
| resources: | ||
| - virtualmachineinstances/vnc |
There was a problem hiding this comment.
This is the most egregious half of B1: granting get on virtualmachineinstances/vnc cluster-wide to system:authenticated lets any tenant SA open an interactive VNC console to any VM in any other tenant's namespace. See B1 in the body — the entire system:authenticated block needs scoping back to truly cluster-scoped resources.
| resources: | ||
| - tenantmodules | ||
| - tenantnamespaces | ||
| - tenantsecrets |
There was a problem hiding this comment.
B1 (body): tenantsecrets cluster-wide to system:authenticated lets any tenant read every other tenant's secrets via the TenantSecret API. Tenant-scoped resources must not be granted through the cluster-wide binding.
| openapiUIK8sBff: | ||
| image: ghcr.io/cozystack/cozystack/openapi-ui-k8s-bff:v1.3.0@sha256:1b3ea6d4c7dbbe6a8def3b2807fffdfab2ac4afc39d7a846e57dd491fa168f92 | ||
| console: | ||
| image: 999669/cozystack-ui:latest@sha256:c5b0dcfa241603763150188150d56ab58fba1ea820bfdac92c601199057bf9a2 |
There was a problem hiding this comment.
B2 (body): personal-account image. The Makefile's image-console target writes $(REGISTRY)/cozystack-ui to this field on every build — please re-run with REGISTRY=ghcr.io/cozystack/cozystack and commit the regenerated values.yaml.
There was a problem hiding this comment.
The 999669/... digest is a development snapshot built locally. The image-console Makefile target automatically overwrites values.yaml with $(REGISTRY)/cozystack-ui:<tag>@<digest> on every build — the release CI run with REGISTRY=ghcr.io/cozystack/cozystack will replace this value before publishing the chart. We attempted to rebuild and push with the official registry but don't have write:packages permissions for the cozystack organization. The build itself completed successfully; the push requires release CI credentials.
… naming Remove namespace-scoped resources (tenantsecrets, tenantnamespaces, tenantmodules, virtualmachineinstances, virtualmachineinstances/vnc) from the cozystack-dashboard-readonly ClusterRole bound to system:authenticated. These resources must be accessed via per-namespace RoleBindings created by the tenant operator, not through a cluster-wide grant to all authenticated users. Only truly cluster-scoped, public-by-design resources remain in the ClusterRole: applicationdefinitions, storageclasses, backupclasses, and dashboard.cozystack.io customization resources. Also rename the leftover incloud-web-web-user-edit ClusterRoleBinding to cozystack-dashboard-cluster-admin to match the new naming convention, and declare Makefile targets as .PHONY. Signed-off-by: IvanHunters <ivan.okhotnikov@aenix.io>
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
packages/system/dashboard/Makefile (1)
16-18: Consider replacing full clone with a minimal fetch path.Current flow starts with
git clone --no-checkout, which is heavier than needed for a single pinned ref build.⚙️ Suggested lightweight checkout flow
- git clone --no-checkout $(CONSOLE_REPO) .tmp-cozystack-ui - git -C .tmp-cozystack-ui fetch --depth 1 origin $(CONSOLE_REF) + git init .tmp-cozystack-ui + git -C .tmp-cozystack-ui remote add origin $(CONSOLE_REPO) + git -C .tmp-cozystack-ui fetch --depth 1 origin $(CONSOLE_REF) git -C .tmp-cozystack-ui checkout FETCH_HEAD🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@packages/system/dashboard/Makefile` around lines 16 - 18, Replace the heavy "git clone --no-checkout $(CONSOLE_REPO) .tmp-cozystack-ui" flow with a minimal, shallow fetch and detached checkout: create an empty repo in .tmp-cozystack-ui (git init), add the remote pointing to $(CONSOLE_REPO), fetch only the single ref with depth 1 (git fetch --depth 1 origin $(CONSOLE_REF)), then checkout the fetched ref in detached mode (checkout --detach FETCH_HEAD); update the existing lines that run "git -C .tmp-cozystack-ui fetch --depth 1 origin $(CONSOLE_REF)" and "git -C .tmp-cozystack-ui checkout FETCH_HEAD" to match this sequence and remove the initial full clone invocation to avoid unnecessary data transfer and refs.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@packages/system/dashboard/Makefile`:
- Line 9: The two image subtargets (image-console and image-token-proxy) both
mutate values.yaml and can race when make -j runs prerequisites in parallel;
change the image target so it runs the two steps serially in one recipe instead
of as separate parallel prerequisites—e.g., replace the current prerequisite
list on the image target with a single recipe that invokes the subtargets
sequentially (call make image-console && make image-token-proxy or perform the
two edits in order inside one shell block) so modifications to values.yaml
cannot run concurrently.
---
Nitpick comments:
In `@packages/system/dashboard/Makefile`:
- Around line 16-18: Replace the heavy "git clone --no-checkout $(CONSOLE_REPO)
.tmp-cozystack-ui" flow with a minimal, shallow fetch and detached checkout:
create an empty repo in .tmp-cozystack-ui (git init), add the remote pointing to
$(CONSOLE_REPO), fetch only the single ref with depth 1 (git fetch --depth 1
origin $(CONSOLE_REF)), then checkout the fetched ref in detached mode (checkout
--detach FETCH_HEAD); update the existing lines that run "git -C
.tmp-cozystack-ui fetch --depth 1 origin $(CONSOLE_REF)" and "git -C
.tmp-cozystack-ui checkout FETCH_HEAD" to match this sequence and remove the
initial full clone invocation to avoid unnecessary data transfer and refs.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 3e688f62-4f5f-463d-9f86-98a810213c01
📒 Files selected for processing (3)
packages/system/dashboard/Makefilepackages/system/dashboard/templates/clusterrolebinding-web-user-edit.yamlpackages/system/dashboard/templates/rbac.yaml
✅ Files skipped from review due to trivial changes (1)
- packages/system/dashboard/templates/clusterrolebinding-web-user-edit.yaml
🚧 Files skipped from review as they are similar to previous changes (1)
- packages/system/dashboard/templates/rbac.yaml
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@packages/system/dashboard/templates/configmap.yaml`:
- Line 7: The ConfigMap is rendering config.json as a YAML object because
`config.json: {{ $branding | toJson }}` emits raw JSON; change the template so
the value is emitted as a YAML string by piping the JSON through the Helm/Go
template quote filter (apply toJson | quote) for the `config.json` key (template
variable `$branding`) so Kubernetes ConfigMap.data receives a string.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: c04f93a9-fb6e-4898-989f-5e7866048453
📒 Files selected for processing (2)
packages/system/dashboard/templates/configmap.yamlpackages/system/dashboard/templates/console.yaml
🚧 Files skipped from review as they are similar to previous changes (1)
- packages/system/dashboard/templates/console.yaml
Add cozy-dashboard-console-config ConfigMap that renders _cluster.branding values as JSON. The new console SPA fetches this ConfigMap at startup via the Kubernetes API (/api/v1/namespaces/cozy-dashboard/configmaps/...) and applies titleText, logoSvg, logoText without requiring nginx volume mounts or pod restarts. Add Role/RoleBinding granting system:authenticated read access to the specific ConfigMap so the browser-side K8s API call succeeds. Signed-off-by: IvanHunters <ivan.okhotnikov@aenix.io>
Includes branding config fetch, backup/VNC fixes, and signoff cleanup. Signed-off-by: IvanHunters <ivan.okhotnikov@aenix.io>
There was a problem hiding this comment.
♻️ Duplicate comments (1)
packages/system/dashboard/Makefile (1)
9-9:⚠️ Potential issue | 🟠 MajorSerialize
imagesubtargets to preventvalues.yamlwrite races.At Line 9,
make -jcan executeimage-consoleandimage-token-proxyin parallel, but both do in-place edits tovalues.yaml(Line 33 and Line 49). This can cause nondeterministic/lost updates.💡 Proposed fix
.PHONY: image image-console image-token-proxy +.NOTPARALLEL: image image: image-console image-token-proxy🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@packages/system/dashboard/Makefile` at line 9, The 'image' target currently lists 'image-console image-token-proxy' as parallel prerequisites which allows make -j to run them concurrently and race on editing values.yaml; change the Makefile so the two subtargets run serially: either make 'image' have a recipe that invokes "make image-console && make image-token-proxy" or make 'image-token-proxy' depend on 'image-console' (so invoking 'image' runs them in order), ensuring all edits to values.yaml (performed in the image-console and image-token-proxy targets) happen sequentially to eliminate write races.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Duplicate comments:
In `@packages/system/dashboard/Makefile`:
- Line 9: The 'image' target currently lists 'image-console image-token-proxy'
as parallel prerequisites which allows make -j to run them concurrently and race
on editing values.yaml; change the Makefile so the two subtargets run serially:
either make 'image' have a recipe that invokes "make image-console && make
image-token-proxy" or make 'image-token-proxy' depend on 'image-console' (so
invoking 'image' runs them in order), ensuring all edits to values.yaml
(performed in the image-console and image-token-proxy targets) happen
sequentially to eliminate write races.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 2f1790ea-c3eb-4c97-b725-252e5b7f4d02
📒 Files selected for processing (3)
packages/system/dashboard/Makefilepackages/system/dashboard/templates/console-rbac.yamlpackages/system/dashboard/templates/console.yaml
✅ Files skipped from review due to trivial changes (1)
- packages/system/dashboard/templates/console-rbac.yaml
🚧 Files skipped from review as they are similar to previous changes (1)
- packages/system/dashboard/templates/console.yaml
toJson returns a string that must be quoted in YAML data fields, otherwise Kubernetes API rejects the manifest as the value is parsed as an object instead of a string. Signed-off-by: IvanHunters <ivan.okhotnikov@aenix.io>
Add pre-upgrade/pre-install hook that labels and annotates the branding ConfigMap with Helm ownership metadata, allowing Helm to adopt resources that were created outside of Helm. Add checksum/config annotation to console pod template so that branding changes trigger an automatic rolling restart, matching the behavior of the previous dashboard chart. Signed-off-by: IvanHunters <ivan.okhotnikov@aenix.io>
…te race When make -j is used, image-console and image-token-proxy could run concurrently and both do in-place edits to values.yaml, causing one update to be silently lost. Add .NOTPARALLEL to force serial execution. Signed-off-by: IvanHunters <xorokhotnikov@gmail.com>
After the UI migration bookmarks and external links pointing to /openapi-ui/... return 404. Add an nginx server-snippet to issue a 301 redirect to / for those paths. Signed-off-by: IvanHunters <xorokhotnikov@gmail.com>
Replace git clone --no-checkout with a minimal git init + remote add + fetch --depth 1 to avoid downloading unnecessary refs. Split the image-console monolith into clone-console, build-console, update-values-console, and clean-console for easier failure isolation. Signed-off-by: IvanHunters <xorokhotnikov@gmail.com>
GitHub does not allow fetching arbitrary commits by SHA without uploadpack.allowReachableSHA1InWants. Replace the git init + fetch approach with a simple shallow clone of the main branch. Signed-off-by: IvanHunters <xorokhotnikov@gmail.com>
…ial registry - Switch CONSOLE_BRANCH to feat/ui-overhaul (main has broken TS build) - Update console image to ghcr.io/cozystack/cozystack/cozystack-ui Signed-off-by: IvanHunters <xorokhotnikov@gmail.com>
Signed-off-by: IvanHunters <xorokhotnikov@gmail.com>
rancher/kubectl:v1.29.10 lacks /bin/sh on Talos clusters, causing the pre-upgrade hook Job to fail. Switch to docker.io/clastix/kubectl:v1.32 which is already used across other dashboard hooks and has /bin/sh available. Signed-off-by: IvanHunters <xorokhotnikov@gmail.com>
Prevents "already exists" errors on repeated hook runs by deleting hook resources before creating new ones. Signed-off-by: IvanHunters <xorokhotnikov@gmail.com>
Switch from non-existent latest digest to the available feat-ui-overhaul image in the official cozystack registry. Signed-off-by: IvanHunters <xorokhotnikov@gmail.com>
Signed-off-by: myasnikovdaniil <60174387+myasnikovdaniil@users.noreply.github.com>
Summary
Replaces the old openapi-ui with the new cozystack-ui build from the cozystack-ui repository.
Key Changes
New UI
999669/cozystack-ui:latest@sha256:ea4e832c2...linux/amd64Removed Components
RBAC Updates
cozystack.io/applicationdefinitionsto fix 403 errorsBug Fixes
Testing
Tested on dev3.infra.aenix.org cluster:
Migration Notes
The new UI is a complete rewrite with: