cozystack Files

Fixes

• [kubernetes] Fix CiliumNetworkPolicy endpointSelector for multi-node RWX volumes: When an NFS-backed RWX volume is published to multiple VMs, the network policy's endpointSelector was only capturing the first VM. Subsequent volume publications added owner references but never broadened the selector, causing Cilium to block NFS egress and making mounts hang on all nodes except the first. The fix switches from matchLabels to matchExpressions (operator: In) so the selector lists all VM names and is rebuilt whenever owner references change (@mattia-eleuteri in [#2227], [#2228]).

• [dashboard] Fix dashboard authentication failures after secret recreation: Added a secret-hash annotation containing the SHA256 hash of the client secret to the dashboard KeycloakClient resource. Without this annotation, if the dashboard-client Secret was recreated (e.g. after an upgrade or reinstall), the KeycloakClient spec stayed unchanged, the EDP Keycloak operator skipped reconciliation, and Keycloak kept the stale secret — causing dashboard authentication failures. Now any secret value change updates the annotation hash, triggering operator reconciliation and syncing the new secret to Keycloak (@sircthulhu in [#2231], [#2240]).

• [etcd] Fix defrag CronJob accumulating pods during cluster upgrades: Added protective limits to the etcd defragmentation CronJob to prevent job pile-up when etcd is temporarily unavailable during upgrades. Without concurrencyPolicy: Forbid, new jobs kept being created hourly while previous ones were still failing, accumulating hundreds of running/failed pods across tenants. The fix adds concurrencyPolicy: Forbid, a startingDeadlineSeconds: 300 guard against missed schedules, a 30-minute job timeout, and limits retries to 2 (@sircthulhu in [#2233], [#2235]).

Documentation

• [website] Document keycloakInternalUrl platform value: Added documentation for the authentication.oidc.keycloakInternalUrl platform value to the Platform Package Reference, Self-Signed Certificates guide, and Enable OIDC Server pages. This value routes dashboard backend OIDC requests through the internal Keycloak service, which is useful in environments with self-signed certificates (@sircthulhu in cozystack/website#452).

• [website] Publish Cozystack v1.0 release announcement: Added the official Cozystack v1.0 release announcement blog post and supporting images, celebrating the first stable release of the platform (@tym83 in cozystack/website#453, cozystack/website#454).

Full Changelog: https://github.com/cozystack/cozystack/compare/v1.0.5...v1.0.6