v1.6.5 (2026-10-16)

A patch release with backported fixes for tenant Kubernetes cluster bootstrap, Application updates through the API, suspended HelmRelease handling, Cilium and Kube-OVN address allocation, tcp-balancer on HAProxy 3.3+, Alertmanager delivery, and a batch of PostgreSQL, MongoDB, NATS, etcd, Velero and dashboard fixes, plus optional email alert delivery, OpenBao static-key auto-unseal and zone placement for Keycloak. This release contains a breaking change on the Kube-OVN platform variants — read the upgrade notes before upgrading.

Features and Improvements

• feat(monitoring): add optional email receiver to alertmanager: Alerta alerts can now be delivered by email through an optional receiver configured in the monitoring application values, with the alert severity guard tightened so rules using non-Alerta severities are caught (@yankawai in [#3800], backport [#4614]).

• feat(openbao): optional static-key auto-unseal and apiserver egress label: OpenBao can now be auto-unsealed with a static key instead of manual Shamir unseal, with the seal values constrained so only valid settings reach the server config, and the pods can carry an apiserver egress label for network-policy setups. The static seal trade-off and the Shamir migration path are documented in the chart (@yankawai in [#4766], backport [#4906]).

• feat(keycloak): expose zone placement for Keycloak and the database proxy: Keycloak, its database proxy and the keycloak-db instances can now be spread across zones, so a zone outage no longer takes the identity provider down with it (@sircthulhu in [#4606], backport [#4856]).

Fixes

• fix(kubernetes): break bootstrap-token Job out of Helm hook to unblock fresh installs: The bootstrap-token Job is no longer a post-install,post-upgrade Helm hook, which deadlocked the chart: the release waited for workers, workers could not register without the bootstrap-token Secret, and the Secret was only created after the wait succeeded. Tenant Kubernetes clusters on fresh installs and upgrades no longer get stuck with Provisioned machines that never join (@IvanHunters in [#3887], backport [#4541]).

• fix(api): keep a suspended HelmRelease suspended across an app update: Updating an Application through the API no longer resumes a HelmRelease that an operator or controller suspended. This fixes backup restores of PostgreSQL stalling at TargetPurged because the release was resumed and re-rendered before the purge finished (@myasnikovdaniil in [#4411], backport [#4928]).

• fix(api): preserve foreign HelmRelease metadata and repair empty required fields: Update on an Application now carries over finalizers, owner references and foreign labels/annotations from the live HelmRelease, so a delete racing an update no longer orphans every resource of the release; and a required field written with nothing under it (replicas:) is dropped so the chart default applies, with a warning to the client, instead of failing the release with a "missing property" error (@mattia-eleuteri, @myasnikovdaniil in [#2914], [#3956], backport [#4919]).

• fix(api): let the garbage collector finalize Applications: Deleting an Application no longer leaves the garbage-collection finalizer behind, so Applications finalize instead of hanging in Terminating (@yankawai in [#4610], backport [#4683]).

• fix(cilium)!: take cilium's own addresses from a block kube-ovn does not hand out: On the Kube-OVN variants (isp-full, isp-full-generic) Cilium now runs ipam.mode: cluster-pool with a /29 per node out of the last /21 of networking.podCIDR, and the same block is excluded from Kube-OVN, so Kube-OVN can no longer hand a pod an address Cilium already holds for its router or Gateway API ingress. A post-upgrade hook migrates existing clusters. Breaking, see "Migration and Upgrades" below (@yankawai in [#4778], backport [#4918]).

• fix(tcp-balancer): rename backends and pin HAProxy so the chart starts on 3.3+: Backend names no longer collide with frontend names, HAProxy is pinned to 3.4.4, and an empty whitelist leaves Kubernetes and Talos frontends unfiltered. Enabling whitelistHTTP without a whitelist now fails at render time instead of producing a configuration that rejects all traffic (@yankawai in [#4366], backport [#4516]).

• fix(monitoring): send alerts to every Alertmanager replica: Alerts are now sent to every Alertmanager replica instead of a single one, so alerts are not lost when the replica receiving them is not the active one (@yankawai in [#4889], backport [#4890]).

• fix(velero): bump velero-plugin-for-aws to v1.14.4 so backups work on R2: Updates the AWS plugin so Velero backups to Cloudflare R2 (and compatible S3 stores) work again (@yrahman82 in [#4834], backport [#4854]).

• fix(postgres): read the live Cluster when deciding the WAL-archive prefix: The WAL-archive prefix is now decided from the live CNPG Cluster, so upgrades and restores keep archiving WAL to the right location instead of switching prefix (@mattia-eleuteri in [#4299], backport [#4592]).

• fix(postgres): cap the default shared_buffers at a quarter of the memory limit: The default shared_buffers is capped at a quarter of the memory limit (and at the memory request), so small PostgreSQL instances no longer start with a buffer size that causes out-of-memory kills (@yankawai in [#4724], backport [#4725]).

• fix(mongodb): set the s3 bucket and prefix on the bootstrap restore: The bootstrap restore now gets the S3 bucket and prefix, so restoring a new MongoDB from a backup actually finds the data (@yankawai in [#4779], backport [#4780]).

• fix(nats): enable JetStream for the generated account: JetStream is now enabled for the generated NATS account, so streams and consumers work out of the box (@yankawai in [#4675], backport [#4677]).

• fix(etcd): leave compaction to etcd and pass the real quota to defrag: etcd compaction is left to etcd itself and defragmentation is given the real backend quota, so etcd no longer compacts redundantly or defragments against the wrong size (@yankawai in [#4873], backport [#4874]).

• fix(platform): keep the legacy etcd-operator stopped after etcd adoption: After etcd is adopted by the new operator, the legacy etcd-operator stays stopped instead of being scaled back up and fighting over the same clusters (@yankawai in [#4738], backport [#4739]).

• fix(linstor): use severity warning in piraeus-datastore alerts: The piraeus-datastore alerts now use the warning severity instead of warn, which Alerta did not recognise, so these alerts arrive with the correct severity (@yankawai in [#3799], backport [#4740]).

• fix(dashboard): allow editing free-form objects in application forms: Free-form object fields in application forms can now be edited, and a field is marked invalid when the schema rejects it, instead of being locked or silently accepted (@yankawai in [#4682], backport [#4905]).

• fix(dashboard, foundationdb): show the connection ConfigMap to tenants: The application page gets a ConfigMaps tab, with a copy button per value, for ConfigMaps in the application's resource map, and tenant roles may read the FoundationDB connection ConfigMap — so tenants can obtain their FoundationDB connection string. The tab goes away if the resource map becomes unreadable instead of showing stale names (@yankawai in [#4612], backport [#4684]).

• fix(cert-manager): enable the Gateway API solver in the host cert-manager: The host cert-manager controller now has the Gateway API solver enabled, so ACME HTTP-01 challenges can be solved through Gateway API routes (@lexfrei in [#4039], backport [#4808]).

• fix(kubernetes): apply worker TalosConfigTemplate server-side: The worker TalosConfigTemplate is applied server-side, avoiding conflicts and field ownership problems when it is updated on existing tenant clusters (@mattia-eleuteri in [#4163], backport [#4575]).

• fix(kubernetes): probe Keycloak CRDs by output in oidc-bootstrap cleanup: The OIDC bootstrap cleanup now probes for Keycloak CRDs by their output, so it no longer fails on clusters where those CRDs are absent (@mattia-eleuteri in [#3520], backport [#4571]).

• fix(cozy-lib): round the sanitized CPU request up to a whole milli-CPU: Sanitized CPU requests are rounded up to a whole milli-CPU, so fractional requests no longer produce invalid values that Kubernetes rejects (@mattia-eleuteri in [#3522], backport [#4590]).

Dependencies

• chore(hetzner-robotlb): update robotlb to 0.1.0: Updates hetzner-robotlb to robotlb 0.1.0 (@sircthulhu in [#4557], backport [#4560]).

Development, Testing, and CI/CD

• ci(e2e): run nightly and release-tag e2e on the container lane: Nightly and release-tag E2E runs now use the Talos container lane, with the nightly runner given headroom over its nodes, matching the merge-gating lanes (@lexfrei in [#4828], backport [#4913]).

• fix(e2e-sandbox): install mc from its GitHub release: The sandbox image installs the final mc release from its pinned GitHub asset and verifies its per-architecture checksum, because dl.min.io now returns HTTP 410 and the release-line image build was failing (@lexfrei in [#4447], backport [#4535]).

Documentation

• [website] docs(platform-package): note the /21 the kube-ovn variants keep for cilium: Documents the /21 of networking.podCIDR that the Kube-OVN variants now reserve for Cilium (@yankawai in cozystack/website#739).

• [website] docs(platform-package): document kubevirt.migrations for v1.6: Documents the kubevirt.migrations platform value in the v1.6 docs (@yankawai in cozystack/website#705).

• [website] docs(platform): document the monitoring platform values: Documents the monitoring platform values (@scooby87 in cozystack/website#738).

• [website] docs(platform-package): add publishing.serviceDomain: Adds publishing.serviceDomain to the platform values reference (@lexfrei in cozystack/website#724).

• [website] docs(variants): document the slim platform variants: Documents the isp-slim, isp-slim-generic and isp-hosted-slim variants (@lexfrei in cozystack/website#718).

• [website] docs(talm): document the ZFS export-on-shutdown knob: Documents the talm knob controlling ZFS pool export on shutdown (@lexfrei in cozystack/website#721).

• [website] docs(install): note the talm version pins on the update path: Notes the talm version pins that apply when updating (@lexfrei in cozystack/website#703).

• [website] docs(gpu): select the container variant from bundle values: Documents selecting the GPU container variant from bundle values (@lexfrei in cozystack/website#714).

• [website] fix(operations): replace the component removal recipe that undoes itself: Replaces a component removal recipe that reverted itself, and warns what removing a v0 component destroys (@lexfrei in cozystack/website#684).

• [website] fix(docs): correct stale hairpin-proxy uninstall claim and package names: Corrects a stale hairpin-proxy uninstall claim and package names in enabledPackages examples (@lexfrei in cozystack/website#709).

• [website] docs(development): describe the multi-arch default of make image: Describes the multi-arch default of make image (@lexfrei in cozystack/website#711).

• [website] docs: move the next docs to Talos v1.14.2: Moves the next docs version to Talos v1.14.2 (@lexfrei in cozystack/website#720).

• [website] fix(versions): pin the trunk to published releases and fix released pin headers: Pins the docs trunk to published releases and fixes released pin file headers (@lexfrei in cozystack/website#710).

• [website] docs(marketplace): point the Repositories view to Admin: Points the Marketplace docs at the Admin page for the Repositories view (@kvaps in cozystack/website#700).

• [website] fix(llms): point llms.txt docs links at the current release: Makes llms.txt link to the current release docs (@themoriarti in cozystack/website#737).

• [website] fix(footer): use the LF Projects copyright notice on every page: Uses the LF Projects copyright notice in the footer on every page (@themoriarti in cozystack/website#736).

• [website] docs(community): drop the Russian-language Telegram channel: Removes the Russian-language Telegram channel from the community pages (@tym83 in cozystack/website#744).

• [website] feat(i18n): automated translation pipeline with machine review gate: Adds an automated documentation translation pipeline with a machine review gate (@tym83 in cozystack/website#623).

• [website] feat(blog): announce the CNCF General Technical Review and compliance results: Publishes news and a page on the CNCF General Technical Review and conformance results (@tym83 in cozystack/website#722).

• [website] blog: Oberon RISC5 machine as a Cozystack catalog app: Publishes a news post on the Oberon RISC5 machine as a catalog app (@tym83 in cozystack/website#723).

• [website] docs: update managed apps reference for v1.6.4: Refreshes the managed applications reference for v1.6.4 (@app/cozystack-ci in cozystack/website#712).

• [cozy-proxy] feat(image): publish a linux/amd64 and linux/arm64 index: cozy-proxy v0.4.0 publishes a multi-architecture image index for linux/amd64 and linux/arm64 (@lexfrei in cozystack/cozy-proxy#22).

Migration and Upgrades

Breaking change on the Kube-OVN variants (isp-full, isp-full-generic) — introduced by [#4778] / [#4918] (fix(cilium)!):

• networking.podCIDR must be /20 or wider; otherwise the platform refuses to render and the upgrade stops before anything changes. Widening the value later does not help, because the migration hook refuses a block outside the subnet the cluster was installed with.
• A /21 of /29 blocks caps these variants at 256 nodes.
• Every Cilium agent restarts twice, once for the configuration change and once in the migration hook. While the cilium release is failed, packages that depend on networking wait for it.
• If Kube-OVN has already handed out an address from the last /21, the hook names that address and stops before moving any node. Recreate the pods holding it and the next retry succeeds.
• Rolling back to v1.6.4 restores ipam.mode: kubernetes, but the exclusions stay in the ovn-default subnet and have to be removed by hand.
• isp-hosted is not affected.

Other upgrade notes:

• tcp-balancer: enabling whitelistHTTP now requires a non-empty whitelist; rendering fails otherwise.
• Tenant Kubernetes clusters stuck on v1.6.3/v1.6.4 because of the missing bootstrap-token Secret recover on upgrade; no manual Secret creation is needed.
• PostgreSQL restarts on upgrade for small clusters: a cluster with a memory limit below 512Mi and no explicit shared_buffers (the t1.nano preset and the default t1.micro) now gets shared_buffers set to a quarter of the limit, 64MB for t1.micro, where PostgreSQL used its built-in 128MB before. The setting needs a restart, so CloudNativePG restarts the replicas first and then the primary in place: writes pause for one restart, and a single-instance cluster is unavailable during it. Upgrade in a quiet window, or set postgresql.parameters.shared_buffers yourself beforehand to take the restart on your own schedule. Clusters with 512Mi or more are unchanged.

Contributors

Thanks to everyone who contributed to this patch release:

• @IvanHunters
• @kvaps
• @lexfrei
• @mattia-eleuteri
• @myasnikovdaniil
• @scooby87
• @sircthulhu
• @themoriarti
• @tym83
• @yankawai
• @yrahman82

New Contributors

We're excited to welcome our first-time contributors:

• @themoriarti - First contribution!
• @yrahman82 - First contribution!

Full Changelog: https://github.com/cozystack/cozystack/compare/v1.6.4...v1.6.5