v1.6.1 (2026-08-05)

A patch release with seven fixes covering PostgreSQL, etcd, managed Kubernetes, Keycloak, cozystack-basics, and SeaweedFS, plus release-pipeline reliability fixes and a talm update adding declarative Talos preset knobs.

Fixes

• fix(postgres-operator): align CNPG operator and CRDs to 1.28.2 for PVC resize-deadlock fix: A simultaneous resources + size change on a single-instance PostgreSQL cluster could make the CloudNativePG operator delete the sole primary Pod, classify the PVC as resizing, and never recreate the Pod — wedging the cluster with zero instances and leaving the filesystem resize incomplete. Bumping the operator image and CRDs together to 1.28.2 (which carries upstream's fix, cloudnative-pg#9980 / cloudnative-pg#9981) resolves the deadlock (@scooby87 in [#3510], backport [#3542]).

• chore(etcd-operator): bump etcd-operator to v0.5.4: Rolls up four upstream controller bug fixes: the operator no longer exempts the bootstrap seed from crash-loop self-heal, self-heal now also covers memory-backed etcd members, --initial-cluster-state is derived from cluster phase instead of the seed, and each EtcdCluster's PodDisruptionBudget switches from maxUnavailable to minAvailable (existing clusters are reconciled onto the new field automatically on upgrade). Tenant etcd clusters recover more reliably from member crashes and are less likely to have their PDB block a node drain (@androndo in [#3529], backport [#3538]).

• fix(kubernetes): render the talos-reconcile Job for the default md0 group: On a managed Kubernetes cluster left with the default (undeclared) nodeGroups, the Job that creates each worker's TalosConfigTemplate and patches the control-plane's cert SANs only iterated the user-supplied node-group map, so it silently skipped the implicit md0 group. Nothing failed at install time, since md0 defaults to zero replicas, but the first scale-up (for example, autoscaler-driven growth after enabling ingress-nginx) left new Machines permanently blocked with no matching TalosConfigTemplate. The Job now iterates the same helper that produces the MachineDeployment, so md0 gets its reconcile Job like any explicitly declared group (@myasnikovdaniil in [#3535], backport [#3536]).

• fix(keycloak-configure): patch HelmRelease in release namespace on teardown: The keycloak-configure pre-delete Job cleared the Flux HelmRelease finalizer in a hardcoded namespace that did not match where the release actually installs (cozy-keycloak), so its ServiceAccount was forbidden to patch it, the Job retried forever, and the HelmRelease stuck in Terminating — blocking any uninstall or reinstall of Keycloak. The teardown Job now templates both the release name and namespace from the Helm release itself, so teardown completes correctly (@lexfrei in [#3372], backport [#3478]).

• fix(cozystack-basics): gate the hostname VAP policies on the VAP API: The hostname ValidatingAdmissionPolicy templates rendered unconditionally, so a first install on a cluster where the ValidatingAdmissionPolicy API is unavailable dropped the policies permanently — a later cluster upgrade that gains the API would not bring them back. The templates are now gated on .Capabilities.APIVersions.Has, so they render only where the API exists and are picked up automatically once it becomes available (@lexfrei in [#3409], backport [#3442]).

• fix(seaweedfs): make naming audit fail closed on kubectl and payload errors: hack/seaweedfs-naming-audit.sh, used by operators to classify SeaweedFS instances before the naming-migration cleanup, was fail-open — any kubectl failure or unreadable Helm release payload produced an empty result table indistinguishable from a genuinely clean fleet. Since the runbook uses this script as the gate before deleting old PVCs, a transient API error could have green-lit destroying live data. Every query now fails loudly on error instead of silently reporting "nothing found," and incomplete evidence now falls back to a conservative "direction cannot be established" verdict rather than a wrong deletion candidate (@myasnikovdaniil in [#3436], backport [#3474]).

• chore(release): don't activate kubernetes-nodes on the release-1.6 line: The kubernetes-nodes app package was not ready to ship on the 1.6 line, so its single include is removed from the iaas platform bundle — the platform stops activating the package on this line while its code, API types, and kubernetes-nodes-rd system package are all kept intact for when it is ready (@myasnikovdaniil in [#3437]).

Development, Testing, and CI/CD

• ci(release): carry the finalize fixes onto the 1.6 line: release-1.6 was cut before three release-pipeline fixes landed on main: dropping persist-credentials on checkout (which had let a stale GITHUB_TOKEN silently win over the app token, so the stable tag push created no workflow run and the automated changelog/docs backstops never fired, as happened for v1.6.0), publishing the GitHub release with the merged changelog as its body instead of a placeholder, and dropping a paths-ignore filter that could drop a changelog-only promotion PR. All three are backported so v1.6.1 releases correctly with real release notes (@myasnikovdaniil in [#3530]).

• fix(ci): overlay images from the PR base branch, and publish per-line artifacts: PR validation always overlaid unbuilt packages from cozystack-packages:main, so a release-1.6 PR was tested against main's controller binaries against its own line's charts — which is exactly what made [#3437] above fail install deterministically with a schema-validation error. Each maintained release-X.Y branch now builds and publishes its own packages artifact, and PR validation overlays from the artifact matching the PR's own base branch (@myasnikovdaniil in [#3471], backport [#3514]).

• fix(release): make promote-retag digest verification media-type-agnostic: The v1.6.0 finalize run aborted partway through promoting rc images to stable tags because its post-copy digest check used skopeo inspect --format '{{.Digest}}', which prints nothing for OCI artifacts like cozystack-packages, leaving most repositories without a stable tag and skipping the installer publish. The digest is now computed as the sha256 of the raw manifest, which works identically for container images and OCI artifacts, so promotion can no longer abort mid-way on this class of artifact (@myasnikovdaniil in [#3435], backport [#3473]).

Other repositories

talm v0.34.0

• [talm] feat(charts): add preset value knobs: Exposes timeServers, control-plane component extraArgs, registryMirrors, per-host registryTLS, multiple Layer2 vips, network.preserveExisting, and network.extraLinks (bonds, VLANs, extra addresses and routes) as values on the cozystack, generic, and talm presets, so a node's Talos machine config can be described declaratively instead of via a template fork. Every knob defaults empty and a stock render stays byte-identical; each input Talos would reject fails fast at render time with a hinted error (@lexfrei in cozystack/talm#232).

• [talm] chore(deps): migrate to Helm 4 and drop the cozystack/talos fork: Moves talm's vendored Helm template engine from v3 to v4 and drops the cozystack/talos fork (carried solely for a --skip-verify flag, now reimplemented locally), tracking stock upstream Talos v1.13.7. Golden render snapshots confirm the generated machine config is unchanged for users (@lexfrei in cozystack/talm#231).

Documentation

• [website] feat(blog): add Cozystack 1.6 release and Blockstor announcement: Publishes the v1.6.0 release-announcement blog post — covering Talos Linux tenant workers, tenant-controlled OIDC, the SecurityGroup API, hierarchical quotas, and in-place etcd-operator adoption — alongside a companion post announcing the open-sourcing of Blockstor, the LINSTOR-compatible storage control plane (@tym83 in cozystack/website#641).

• [website] chore(blog): repair front matter, links and bundle names: Follow-up cleanup on the two new blog posts, fixing front matter, internal links, and page bundle names (@tym83 in cozystack/website@4b5d1ad).

• [website] chore: upgrade Hugo to 0.164.0 and convert HTML content to markdown: Upgrades the site generator to Hugo 0.164.0, requiring Node 22 under its new node permission model, and converts remaining raw-HTML content to markdown along the way, keeping the site buildable on current tooling (@tym83 in cozystack/website#636).

• [website] chore(blog): make the two taxonomy axes disjoint: Cleans up the blog's tagging so its two taxonomy axes no longer overlap, making blog post categorization and filtering more consistent (@tym83 in cozystack/website#635).

• [website] docs(talm): describe the preset value knobs for network and registries: Documents the new talm preset value knobs (cozystack/talm#232) for time servers, control-plane extra args, registry mirrors and TLS, VIPs, and network links, so operators can find the declarative equivalents to a template fork (@lexfrei in cozystack/website#633).

• [website] feat(hack): generate docs from a pre-tag ref and fail loudly on fetch errors: Hardens the docs-generation tooling to build from a pinned pre-tag ref and to fail loudly instead of silently on a fetch error, reducing the chance of publishing docs generated from the wrong ref (@myasnikovdaniil in cozystack/website#631).

• [website] docs(backups): document PostgreSQL point-in-time recovery (PITR): Adds documentation for PostgreSQL point-in-time recovery, covering how to configure and perform a PITR restore for managed PostgreSQL clusters (@androndo in cozystack/website#629).

• [website] docs: update managed apps reference for v1.6.0: Refreshes the managed applications reference pages to match what shipped in v1.6.0 (@myasnikovdaniil in cozystack/website#628).

• [website] docs(monitoring): add OIDC authentication guide for Grafana: Adds a guide for configuring OIDC single sign-on authentication for per-instance Grafana, complementing v1.6.0's tenant OIDC support (@IvanHunters in cozystack/website#597).

Contributors

Thanks to everyone who contributed to this patch release:

• @IvanHunters
• @androndo
• @lexfrei
• @myasnikovdaniil
• @scooby87
• @tym83

Full Changelog: https://github.com/cozystack/cozystack/compare/v1.6.0...v1.6.1