feat(kube-ovn): build the chart and image in-tree, retiring the wrapper repo by kvaps · Pull Request #3460 · cozystack/cozystack

Andrei Kvapil (kvaps) · 2026-07-27T18:31:02Z

What this PR does

Brings the kubeovn-chart wrapper into the tree, so cozystack/kubeovn-chart can be archived.

Until now packages/system/kubeovn pulled a chart tarball from the latest cozystack/kubeovn-chart tag at make update time, and that repository also built and pushed the kubeovn image. The wrapper existed only to cache the upstream chart; with the current caching approach that reason is gone, and the split cost a second repository, a second release step, and a package whose provenance a reader cannot follow without leaving the tree.

The package is now shaped like packages/system/cilium:

update pulls the upstream kubeovn/kube-ovn chart directly and applies patches/mtu.diff, then syncs the version into the Dockerfile. The MTU patch already carried monorepo-relative paths, so it applies unchanged.
image builds images/kubeovn (carrying the existing fix-keepvmip-portgroup patch) and pins the digest into values.yaml, using the shared image-tags / cache-args helpers.

It also carries cozystack/kubeovn-chart#5, which never got a tag: OVN_IPSEC_KEY_DIR is pinned under /var/lib. The kube-ovn default sits in /etc/origin, which a Talos node cannot create, so enabling IPsec left the node without ESP security associations.

The nightly host rewrite had to be fixed first

Moving the image build here activates a gap recorded in docs/agents/image-refs.md. The nightly host rewrite is a literal <src-registry>/ substring replace, and kubeovn keeps its host in global.registry.address with the bare repository in a sibling key — no trailing slash, no match. While the image came from a separate repository the baked reference carried the public host and the ownership filter skipped it; once CI builds the image here it stamps the build-registry host into that key, and the result is an image mirrored to the public registry while the published tree keeps pointing at the private build registry.

The second commit adds an end-of-line-anchored expression that fires only when the source registry is the complete scalar value, so a contiguous reference — which continues past the host — is still handled by the first expression and the two can never both fire on one reference. keycloak-operator splits at a different boundary and stays unfixed; that is documented, and dormant while no CI path rebuilds it.

Verified: hack/nightly-mirror_test.bats passes with the new case and the case fails without the fix; promote-retag and promote-rewrite-tags suites unaffected; helm template and helm unittest on the package pass. The pre-existing helm lint complaint about a missing kube-ovn dependency reproduces on main and is left alone.

Follow-ups this PR does not do

cozystack/kubeovn-chart should be archived once this merges, with a pointer here. Its open PR Specify reconcileStrategy: Revision for system charts #5 is carried by this change and needs no separate landing.
cozystack/website links the Kube-OVN license at cozystack/kubeovn-chart in operations/configuration/licenses.md and guides/platform-stack/_index.md (all versions, including next). Archived repositories stay readable so nothing breaks, but the link should move upstream or in-tree. No follow-up has been opened yet — flagging rather than ticking the box.

Screenshots

N/A — build and packaging change, no user-facing or UI impact.

Downstream repositories

Walked the trigger map against the diff. The website row matches — not through the app-list or platform-component triggers, but because two of its pages link the repository being archived. Left unticked because no follow-up exists there yet; a human should decide whether the license link moves to kubeovn/kube-ovn or to this package. No other row matches: the change touches no packages/apps/ or packages/extra/ package, no values.schema.json, no ApplicationDefinition, no platform variant, and no node prerequisite.

Release note

feat(kube-ovn): the Kube-OVN chart and image are now built in this repository instead of cozystack/kubeovn-chart. OVN_IPSEC_KEY_DIR now defaults to /var/lib/ovs_ipsec_keys, so enabling IPsec on Talos nodes no longer leaves them without ESP security associations.

Summary by CodeRabbit

New Features
- Updated Kube-OVN image build to use upstream chart metadata and keep registry/version alignment during update.
- Added conditional MTU support for the OVN CNI DS via chart values.
- Introduced OVN_IPSEC_KEY_DIR to standardize the OVN IPsec keys directory.
Bug Fixes
- Preserved VM networking port-group assignments during live migration when an alive virt-launcher sibling pod exists.
- Improved nightly mirror host rewriting for split and standalone registry host formats.
Tests
- Added coverage for the end-of-line “whole scalar value” host rewrite case.
Documentation
- Refreshed “Known gaps” guidance for nightly mirror host rewriting behavior and limitations.

gemini-code-assist · 2026-07-27T18:31:05Z

Caution

The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased.

coderabbitai · 2026-07-27T18:31:10Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: d2ec3fdf-eccb-4c46-82c0-ee0bc6beca86

📥 Commits

Reviewing files that changed from the base of the PR and between efb6de0 and 6cb5793.

📒 Files selected for processing (8)

docs/agents/image-refs.md
hack/nightly-mirror.sh
hack/nightly-mirror_test.bats
packages/system/kubeovn/Makefile
packages/system/kubeovn/images/kubeovn/Dockerfile
packages/system/kubeovn/images/kubeovn/patches/fix-keepvmip-portgroup.diff
packages/system/kubeovn/patches/mtu.diff
packages/system/kubeovn/values.yaml

🚧 Files skipped from review as they are similar to previous changes (6)

packages/system/kubeovn/patches/mtu.diff
packages/system/kubeovn/values.yaml
hack/nightly-mirror.sh
hack/nightly-mirror_test.bats
packages/system/kubeovn/images/kubeovn/patches/fix-keepvmip-portgroup.diff
docs/agents/image-refs.md

📝 Walkthrough

Walkthrough

The PR extends nightly image host rewriting for scalar registry values and adds coverage for that shape. It also replaces kube-ovn update/build plumbing with an upstream chart workflow, adds a multi-stage image build, applies MTU and VM migration patches, and updates chart values.

Changes

Nightly mirror host rewriting

Layer / File(s)	Summary
Registry host rewrite coverage `hack/nightly-mirror.sh`, `hack/nightly-mirror_test.bats`, `docs/agents/image-refs.md`	The mirror rewrites registry-prefixed references and end-of-line registry scalar values, with tests for unchanged repositories, third-party hosts, and single replacement behavior. Documentation records the supported layout and remaining split-host limitation.

Kube-ovn packaging

Layer / File(s)	Summary
Upstream chart and image build `packages/system/kubeovn/Makefile`, `packages/system/kubeovn/patches/mtu.diff`, `packages/system/kubeovn/images/kubeovn/Dockerfile`	The update target fetches the upstream chart, applies conditional MTU handling, derives the image version from `appVersion`, builds the image, and updates image metadata in `values.yaml`.
Runtime image assembly `packages/system/kubeovn/images/kubeovn/Dockerfile`	The multi-stage build compiles kube-ovn, prepares executable symlinks and Linux capabilities, installs runtime assets, and sets the runtime working directory.
VM migration state and chart values `packages/system/kubeovn/images/kubeovn/patches/fix-keepvmip-portgroup.diff`, `packages/system/kubeovn/values.yaml`	Port-group removal is skipped when another alive virt-launcher sibling exists, and `OVN_IPSEC_KEY_DIR` is added with directory placement documentation.

Estimated code review effort: 4 (Complex) | ~45 minutes

Suggested reviewers: lexfrei, androndo, sircthulhu

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: moving Kube-OVN chart and image builds in-tree and deprecating the wrapper repo.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch feat/kubeovn-return-chart-in-tree

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

The chart and the image are now built in cozystack/cozystack under packages/system/kubeovn; see cozystack/cozystack#3460. PR #5 was carried into that move, so nothing here is left pending. Assisted-By: Claude

gemini-code-assist · 2026-07-27T19:47:16Z

Caution

The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased.

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@packages/system/kubeovn/Makefile`:
- Around line 20-22: Extend the update target after the Dockerfile substitutions
to invoke the existing image target, so make update builds the image and writes
its digest to values.yaml. Preserve the current version extraction and
SED_INPLACE commands, and reuse the Makefile’s existing image workflow rather
than duplicating its steps.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 16fb8f01-41f0-4e37-9f3c-5c156adf8138

📥 Commits

Reviewing files that changed from the base of the PR and between 66c96b4 and efb6de0.

📒 Files selected for processing (8)

docs/agents/image-refs.md
hack/nightly-mirror.sh
hack/nightly-mirror_test.bats
packages/system/kubeovn/Makefile
packages/system/kubeovn/images/kubeovn/Dockerfile
packages/system/kubeovn/images/kubeovn/patches/fix-keepvmip-portgroup.diff
packages/system/kubeovn/patches/mtu.diff
packages/system/kubeovn/values.yaml

coderabbitai · 2026-07-27T19:51:23Z

+	version=$$(awk '$$1 == "appVersion:" {print $$2}' charts/kube-ovn/Chart.yaml) && \
+	$(SED_INPLACE) -e "s/ARG VERSION=.*/ARG VERSION=$${version}/" images/kubeovn/Dockerfile && \
+	$(SED_INPLACE) -e "s/ARG TAG=.*/ARG TAG=v$${version}/" images/kubeovn/Dockerfile


🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

Invoke the image workflow from update.

update stops after modifying the Dockerfile at Line 22. It never runs image, so make update neither builds the image nor writes its digest to values.yaml.

Proposed fix

$(SED_INPLACE) -e "s/ARG VERSION=.*/ARG VERSION=$${version}/" images/kubeovn/Dockerfile && \ $(SED_INPLACE) -e "s/ARG TAG=.*/ARG TAG=v$${version}/" images/kubeovn/Dockerfile + $(MAKE) image

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

version=$$(awk '$$1 == "appVersion:" {print $$2}' charts/kube-ovn/Chart.yaml) && \

$(SED_INPLACE) -e "s/ARG VERSION=.*/ARG VERSION=$${version}/" images/kubeovn/Dockerfile && \

$(SED_INPLACE) -e "s/ARG TAG=.*/ARG TAG=v$${version}/" images/kubeovn/Dockerfile

version=$$(awk '$$1 == "appVersion:" {print $$2}' charts/kube-ovn/Chart.yaml) && \

$(SED_INPLACE) -e "s/ARG VERSION=.*/ARG VERSION=$${version}/" images/kubeovn/Dockerfile && \

$(SED_INPLACE) -e "s/ARG TAG=.*/ARG TAG=v$${version}/" images/kubeovn/Dockerfile

$(MAKE) image

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@packages/system/kubeovn/Makefile` around lines 20 - 22, Extend the update target after the Dockerfile substitutions to invoke the existing image target, so make update builds the image and writes its digest to values.yaml. Preserve the current version extraction and SED_INPLACE commands, and reuse the Makefile’s existing image workflow rather than duplicating its steps.

kubeovn was the last package whose chart and image were produced by a separate repository: packages/system/kubeovn pulled a tarball from the latest cozystack/kubeovn-chart tag at update time, and that repository built and pushed the image. The wrapper existed only to cache the upstream chart; with the current caching that reason is gone, and the split cost a second repository, a second release step, and a package whose provenance a reader could not follow without leaving the tree. Move the wrapper in, shaped like packages/system/cilium: update pulls the upstream kube-ovn chart directly and applies patches/mtu.diff, and image builds images/kubeovn and pins the digest into values.yaml. The MTU patch already carried monorepo-relative paths, so it applies here unchanged. Also carries cozystack/kubeovn-chart#5, which never got a tag: pin OVN_IPSEC_KEY_DIR under /var/lib. The kube-ovn default sits in /etc/origin, which a Talos node cannot create, so enabling IPsec left the node without ESP security associations. Co-authored-by: Timofei Larkin <lllamnyp@gmail.com> Co-authored-by: Kirill Ilin <stitch14@yandex.ru> Co-authored-by: Aleksei Sviridkin <f@lex.la> Assisted-By: Claude Signed-off-by: Andrei Kvapil <andrei.kvapil@aenix.io>

The nightly host rewrite is a literal "<src-registry>/" substring replace, so it only reaches a host sitting contiguously in front of the repository. kubeovn keeps its host in global.registry.address with the bare repository in a sibling key: no trailing slash, no match. The image was mirrored to the public registry and the tree kept pointing at the private build registry. The gap was dormant while kubeovn's image came from a separate repository, because the baked ref carried the public host and the ownership filter skipped it. Building the image in-tree stamps the build-registry host into that key and turns it live, so fix it here. Add an end-of-line-anchored expression that fires only when the source registry is the complete value; a contiguous ref continues past the host, so the two expressions cannot both fire on one reference. keycloak-operator splits at a different boundary and stays unfixed -- neither of its keys holds the source registry as a whole. Documented, and dormant while no CI path rebuilds it. Assisted-By: Claude Signed-off-by: Andrei Kvapil <andrei.kvapil@aenix.io>

IvanHunters

LGTM. Reviewed the current head end-to-end (helm template across default / mtu on-off / ENABLE_OVN_IPSEC on-off, the nightly-mirror bats suite, and byte-diff of charts/kube-ovn against upstream v1.15.10 + mtu.diff). No regressions on any supported path: the image digest in values.yaml is unchanged from main, so running clusters do not swap the image on merge; fresh install renders; upgrade is safe; this PR actually improves air-gap (nightly-mirror fix).

Non-blocking notes for a follow-up:

patches/mtu.diff:4 — hunk counters are off (@@ -122,6 +122,9 @@ should be @@ -122,5 +122,8 @@). GNU patch (used by make update) applies it fine with fuzz, so the re-apply loop is not broken, but the header is worth fixing for robustness.
Makefile:1,20,22 — awk '$1=="appVersion:"{print $2}' returns the value with quotes, so make update would rewrite the Dockerfile ARG as v"1.15.10" and not round-trip. Harmless today but fragile; -F'"' or gsub would fix it.
Follow-up: default render still references a vpc-nat-gateway image that nothing in-tree builds/mirrors (pre-existing, identical to main). Worth confirming its publication survives retiring the wrapper repo.

Andrei Kvapil (kvaps) mentioned this pull request Jul 27, 2026

fix(chart): pin the IPsec key directory to a Talos-writable path cozystack/kubeovn-chart#5

Closed

Andrei Kvapil (kvaps) force-pushed the feat/kubeovn-return-chart-in-tree branch from a5f8177 to efb6de0 Compare July 27, 2026 19:23

github-actions Bot added area/networking Issues or PRs related to networking (ingress, gateway, vpn, metallb, kube-ovn) kind/feature Categorizes issue or PR as related to a new feature labels Jul 27, 2026

Andrei Kvapil (kvaps) marked this pull request as ready for review July 27, 2026 19:46

Andrei Kvapil (kvaps) requested review from IvanHunters, Andrey Kolkov (androndo), Aleksei Sviridkin (lexfrei), Timofei Larkin (lllamnyp), myasnikovdaniil and Kirill Ilin (sircthulhu) as code owners July 27, 2026 19:46

dosubot Bot added the area/build Issues or PRs related to image build infrastructure, multi-arch support label Jul 27, 2026

coderabbitai Bot reviewed Jul 27, 2026

View reviewed changes

github-actions Bot added the size/L This PR changes 100-499 lines, ignoring generated files label Jul 27, 2026

Andrei Kvapil (kvaps) and others added 2 commits July 28, 2026 18:07

Andrei Kvapil (kvaps) force-pushed the feat/kubeovn-return-chart-in-tree branch from efb6de0 to 6cb5793 Compare July 28, 2026 16:07

IvanHunters approved these changes Jul 28, 2026

View reviewed changes

Andrei Kvapil (kvaps) merged commit 3dc0f56 into main Jul 29, 2026
34 of 37 checks passed

Andrei Kvapil (kvaps) deleted the feat/kubeovn-return-chart-in-tree branch July 29, 2026 16:19

Navigation Menu

Uh oh!

feat(kube-ovn): build the chart and image in-tree, retiring the wrapper repo - #3460

feat(kube-ovn): build the chart and image in-tree, retiring the wrapper repo#3460
Andrei Kvapil (kvaps) merged 2 commits into
mainfrom
feat/kubeovn-return-chart-in-tree

Andrei Kvapil (kvaps) commented Jul 27, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

gemini-code-assist Bot commented Jul 27, 2026

Uh oh!

coderabbitai Bot commented Jul 27, 2026 •

edited

Loading

Walkthrough

Changes

Uh oh!

gemini-code-assist Bot commented Jul 27, 2026

Uh oh!

coderabbitai Bot left a comment

Uh oh!

coderabbitai Bot Jul 27, 2026

Uh oh!

IvanHunters left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

Andrei Kvapil (kvaps) commented Jul 27, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What this PR does

The nightly host rewrite had to be fixed first

Follow-ups this PR does not do

Screenshots

Downstream repositories

Release note

Summary by CodeRabbit

Uh oh!

gemini-code-assist Bot commented Jul 27, 2026

Uh oh!

coderabbitai Bot commented Jul 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Uh oh!

gemini-code-assist Bot commented Jul 27, 2026

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

coderabbitai Bot Jul 27, 2026

Choose a reason for hiding this comment

Uh oh!

IvanHunters left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Andrei Kvapil (kvaps) commented Jul 27, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Jul 27, 2026 •

edited

Loading