v1.4.2 (2026-05-27)

A patch release shipping two kubevirt-csi-driver reliability fixes for persistent-volume attach failures and a platform fix that makes OpenSearch available in the PaaS bundle. All main-repo changes are backports of PRs already merged to main.

Fixes

• fix(platform): add OpenSearch to PaaS bundle: OpenSearch packages (opensearch-operator, opensearch-rd) have been present in the repository for several releases, but the PaaS bundle template (bundles.paas.enabled=true) never referenced the two cozystack.opensearch-* PackageSources. As a result the operator was not deployed (no OpenSearchCluster CRD), the ApplicationDefinition/opensearch was never created, and the dashboard catalog showed no OpenSearch entry — tenants could not provision OpenSearch instances regardless of what was installed. The two missing includes are now added to the PaaS bundle alongside every other database operator (@myasnikovdaniil in [#2648], backport [#2757]).

• fix(csi): route RWX Block volumes to upstream hotplug detach: ControllerUnpublishVolume in the kubevirt-csi-driver wrapper selected the NFS cleanup branch using only hasRWXAccessMode(pvc). KubeVirt live-migration disks (RWX Block PVCs) matched that check and were sent down the NFS path, which only deletes a CiliumNetworkPolicy. Because no such CNP exists for block volumes, the function returned success without calling upstream's hotplug detach — leaving the DataVolume entry in VM.spec.template.spec.volumes permanently. When the same PVC later attached to a different VM, linstor-csi's anti-split-brain check rejected the attach. The fix introduces isNFSVolume(pvc), which requires both ReadWriteMany access mode and VolumeMode=Filesystem, accurately matching only NFS-backed PVCs. The same predicate replaces the access-mode-only check in ControllerExpandVolume, which was incorrectly skipping in-VM disk expansion for RWX Block volumes (@myasnikovdaniil in [#2658], backport [#2749]).

• fix(csi): verify VMI Ready after kubevirt-csi Publish to surface stuck-PVC failures: Upstream ControllerPublishVolume has a fast path (EnsureVolumeAvailableVM) that considers a volume attached as soon as its entry appears in VM.spec.template.spec.volumes. If a previous Publish wrote that entry but the hotplug never completed — e.g. because the backing PVC is stuck ClaimPending due to LINSTOR being unable to autoplace — the retry hits the fast path and reports success. external-attacher then sets VolumeAttachment.Attached=true, but QEMU was never sent device_add, so the tenant kubelet's NodeStageVolume fails with couldn't find device by serial id. The wrapper now re-reads VMI.Status.VolumeStatus after upstream returns success and returns codes.Unavailable (with the upstream reason, e.g. PVC is in phase ClaimPending) if the volume is not in VolumeReady phase. This keeps external-attacher retrying and surfaces the underlying provisioning failure at the CSI layer rather than as a confusing kubelet-side error (@myasnikovdaniil in [#2659], backport [#2748]).

Documentation

• [website] Update Cozystack logo, favicons, and social banner: Refreshes the website branding to the new Cozystack logo — a new horizontal wordmark for the navigation bar, regenerated favicon set, and an updated Open Graph social banner. The navbar logo height is adjusted from 30 px to 36 px for improved readability (@kvapsova in cozystack/website#551).

• [website] Cilium Gateway API — architecture, security, and migration guide: Adds a comprehensive networking/gateway-api.md page for the Cilium-backed Gateway API feature. The guide covers the platform-level gateway.enabled toggle and per-tenant tenant.spec.gateway opt-in, inheritance of the parent Gateway through the namespace.cozystack.io/gateway label, HTTP-01 and DNS-01 certificate modes (four DNS providers), per-service HTTPRoute and TLSRoute tables, a five-layer security model, and a step-by-step migration path from ingress-nginx for new and existing clusters. The platform-package reference is extended with the gateway.* and publishing.certificates.dns01.* value rows (@lexfrei in cozystack/website#509).

• [website] Pin cozystack download URLs in v0 docs: Fixes broken download links in the v0 installation documentation. releases/latest/download/ now resolves to v1.4.x where the legacy cozystack-installer.yaml asset no longer exists. All affected URLs are pinned to the v0.41.11 tag via a version-pin shortcode, including the installer manifest (three pages), metal image downloads (two pages), and the Oracle Cloud guide's wget command. The talm download in the Oracle Cloud guide is also fixed from the dropped bare-binary asset name to the .tar.gz archive (@lexfrei in cozystack/website#548).

Contributors

Thanks to everyone who contributed to this patch release:

• @kvapsova
• @lexfrei
• @myasnikovdaniil

Full Changelog: https://github.com/cozystack/cozystack/compare/v1.4.1...v1.4.2