v1.4.5 (2026-07-03)

A patch release with fixes for tenant control-plane deletion, VM node-group sizing, Harbor storage-class drift, CSI hot-plug volume handling, and a new talm v0.32.0 with encrypted user values.

Fixes

• fix(kamaji): backport datastore unused-deletion deadlock fix (clastix/kamaji#1122): Deleting a tenant whose etcd DataStore had zero referencing TenantControlPlanes left the DataStore stuck in Terminating (blocked by the kamaji.clastix.io/TenantControlPlane finalizer), which hung the etcd Helm uninstall and wedged the whole tenant namespace. Tenant deletion involving an otherwise-idle DataStore now completes cleanly instead of hanging indefinitely (@myasnikovdaniil in [#3146], backport [#3188]).
• fix(kubernetes): gate vmop cert-manager-crds dependency on certManager.enabled: The victoria-metrics-operator HelmRelease unconditionally depended on cert-manager-crds, even though that HelmRelease is only created when certManager.enabled is true. Clusters with monitoringAgents.enabled=true and certManager.enabled=false therefore failed with a "not found" error on vmop, which cascaded into monitoring-agents and vertical-pod-autoscaler never installing. This previously-broken combination now installs correctly (@myasnikovdaniil in [#3130], backport [#3186]).
• fix(kubernetes): make node group resources optional and prefer them over instanceType: Node groups sized purely by instanceType (with resources omitted) failed values.schema.json validation, even though sizing was fully specified. resources is now optional, and when both instanceType and explicit resources (both cpu and memory) are set, the explicit resources take precedence over the instance type. A partial spec with only one of cpu/memory alongside an instanceType now fails fast at render time with a clear error instead of producing an invalid VM spec (@lexfrei in [#3121], backport [#3157]).
• fix(harbor): preserve jobservice and trivy storageClass on upgrade: The cozy-harbor wrapper never forwarded storageClass to the jobservice job-log PVC, so it was created without a storageClassName, and the default-StorageClass admission then stamped the cluster default onto it. Because storageClassName is immutable, this caused permanent drift between the rendered and live state on every upgrade. The same latent drift existed for Trivy's volumeClaimTemplate. Both now preserve an existing PVC/VCT's storage class via lookup, falling back to the configured storageClass only for fresh installs, so upgrades no longer show spurious storage-class drift (@myasnikovdaniil in [#2930], backport [#3151]).
• fix(kubernetes): add spec.timeout to tenant CSI HelmRelease: The tenant kubevirt-csi-node HelmRelease was the only tenant addon without an explicit timeout: 10m (all others already had it), so it fell back to Helm's default 5-minute timeout. On slower tenant control-plane bring-up, the CSI DaemonSet could still be InProgress past 5 minutes, causing helm-controller to trigger a remediation uninstall/reinstall cycle mid-flight and wedge any in-progress volume mount. Aligning the timeout with the other tenant HelmReleases removes this source of intermittent CSI install/remediation flapping (@myasnikovdaniil in [#2727], backport [#2929]).
• fix(csi): detach orphan hot-plug volumes from VMI when parent VM is gone: Upstream treated a missing parent VM as detach success, so when a VMI outlived its VM during node reprovisioning, the hot-plug pod kept the infra device exclusively attached to the source host and subsequent attach attempts failed. The CSI driver now re-checks VMI volume status after the upstream unpublish call and detaches directly from the VMI when needed, and kubevirt-csi-driver is bumped to the latest upstream release carrying this fix, resolving stuck volume attachments after node reprovisioning (@kvaps in [#2866], backport [#2965]).

Other repositories

talm v0.32.0

• [talm] feat: first-class encrypted user values, honored at template and apply: Adds support for arbitrary encrypted user secret values (registry passwords, KMS plugin secret IDs, etc.) consumed by chart templates. Value files named *.encrypted.yaml are age-decrypted in memory via the existing talm.key at both template and apply time — plaintext never touches disk. talm init --encrypt/--decrypt now covers values-secret.yaml ↔ values-secret.encrypted.yaml. Secret-bearing fields are omitted from committed nodes/*.yaml files and redacted by default in talm template stdout and talm apply's drift preview (--show-secrets/--show-secrets-in-drift reveal them on demand). talm apply also now honors the full set of value-source flags and templateOptions from Chart.yaml, so a value supplied at template time is no longer silently dropped at apply (@lexfrei in cozystack/talm#222).

Documentation

• [website] docs(operations): add containerized GPU workloads guide: Adds a guide covering running GPU workloads in containers on Cozystack, helping operators evaluate and configure GPU-accelerated container deployments (@lexfrei in cozystack/website#555).
• [website] docs(talm): document chart drift detection and strict mode: Documents talm's chart drift detection and strict mode, explaining how operators can catch and control configuration drift between rendered and applied charts (@lexfrei in cozystack/website#577).
• [website] docs(talos): warn against changing op: on the machine files block: Adds a warning against changing the op: field on the Talos machine files block, helping operators avoid a known misconfiguration pitfall (@lexfrei in cozystack/website#575).
• [website] docs(platform): document publishing.certificates wildcard options: Documents the publishing.certificates wildcard options for the platform chart, clarifying how operators can configure wildcard certificates for published services (@lexfrei in cozystack/website#588).

Contributors

Thanks to everyone who contributed to this patch release:

• @kvaps
• @lexfrei
• @myasnikovdaniil

Full Changelog: https://github.com/cozystack/cozystack/compare/v1.4.4...v1.4.5