Skip to content

69 integration with proxmox paas proxmox bundle - #1924

Merged
Marian Koreniuk (themoriarti) merged 15 commits into
cozystack:69-integration-with-proxmox-paas-proxmox-bundlefrom
themoriarti:69-integration-with-proxmox-paas-proxmox-bundle
Jan 27, 2026
Merged

Marian Koreniuk (themoriarti) merged 15 commits into
cozystack:69-integration-with-proxmox-paas-proxmox-bundlefrom
themoriarti:69-integration-with-proxmox-paas-proxmox-bundle

Conversation

@themoriarti

Copy link
Copy Markdown
Collaborator

from fork to integration proxmox original

Introduce a new "External IPs" sidebar and associated dashboard factory to display services of type LoadBalancer.

Signed-off-by: Kirill Ilin <[email protected]>
## What this PR does

This patch enables the `offline_access` scope for the dashbord keycloak
client, so that users get a refresh token which gatekeeper can use to
automatically refresh an expiring access token. Also session timeouts
were increased.

### Release note

```release-note
[dashboard] Increase session timeouts, add the offline_access scope,
enable refresh tokens to improve the overall user experience when
working with the dashboard.
```

Signed-off-by: Timofei Larkin <[email protected]>
<!-- Thank you for making a contribution! Here are some tips for you:
- Start the PR title with the [label] of Cozystack component:
- For system components: [platform], [system], [linstor], [cilium],
[kube-ovn], [dashboard], [cluster-api], etc.
- For managed apps: [apps], [tenant], [kubernetes], [postgres],
[virtual-machine] etc.
- For development and maintenance: [tests], [ci], [docs], [maintenance].
- If it's a work in progress, consider creating this PR as a draft.
- Don't hesistate to ask for opinion and review in the community chats,
even if it's still a draft.
- Add the label `backport` if it's a bugfix that needs to be backported
to a previous version.
-->

## What this PR does

Fixes filtering pods on Pods tab of Service details page

### Release note

<!--  Write a release note:
- Explain what has changed internally and for users.
- Start with the same [label] as in the PR title
- Follow the guidelines at
https://github.com/kubernetes/community/blob/master/contributors/guide/release-notes.md.
-->

```release-note
[dashboard] Fix filtering pods on Pods tab for Service
```

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Bug Fixes**
* Corrected label selector field name in pod details table configuration
to ensure proper label filtering functionality.

<sub>✏️ Tip: You can customize this high-level summary in your review
settings.</sub>

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
cozystack#1912)

<!-- Thank you for making a contribution! Here are some tips for you:
- Start the PR title with the [label] of Cozystack component:
- For system components: [platform], [system], [linstor], [cilium],
[kube-ovn], [dashboard], [cluster-api], etc.
- For managed apps: [apps], [tenant], [kubernetes], [postgres],
[virtual-machine] etc.
- For development and maintenance: [tests], [ci], [docs], [maintenance].
- If it's a work in progress, consider creating this PR as a draft.
- Don't hesistate to ask for opinion and review in the community chats,
even if it's still a draft.
- Add the label `backport` if it's a bugfix that needs to be backported
to a previous version.
-->

## What this PR does

Add labels and selectors for Service and Ingress resources to correctly
show them in corresponding tabs for Kubernetes app in dashboard

### Release note

<!--  Write a release note:
- Explain what has changed internally and for users.
- Start with the same [label] as in the PR title
- Follow the guidelines at
https://github.com/kubernetes/community/blob/master/contributors/guide/release-notes.md.
-->

```release-note
[kubernetes] show Ingress and Service resources in dashboard
```

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Chores**
* Introduced standardized metadata labels across Kubernetes application
resources including cloud configuration, ingress, and service components
to improve resource organization, tracking, identification, and
multi-tenant environment management
* Extended the system's resource management framework to include and
manage additional Kubernetes infrastructure components, such as
ingress-nginx, enhancing overall cluster orchestration and service
networking capabilities

<sub>✏️ Tip: You can customize this high-level summary in your review
settings.</sub>

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
…#1908)

Introduce a new "External IPs" sidebar and associated dashboard factory
to display services of type LoadBalancer.

<!-- Thank you for making a contribution! Here are some tips for you:
- Start the PR title with the [label] of Cozystack component:
- For system components: [platform], [system], [linstor], [cilium],
[kube-ovn], [dashboard], [cluster-api], etc.
- For managed apps: [apps], [tenant], [kubernetes], [postgres],
[virtual-machine] etc.
- For development and maintenance: [tests], [ci], [docs], [maintenance].
- If it's a work in progress, consider creating this PR as a draft.
- Don't hesistate to ask for opinion and review in the community chats,
even if it's still a draft.
- Add the label `backport` if it's a bugfix that needs to be backported
to a previous version.
-->

## What this PR does

Add External IPs tab to sidebar with all `Service` resources of type
`LoadBalancer` in tenant

### Release note

<!--  Write a release note:
- Explain what has changed internally and for users.
- Start with the same [label] as in the PR title
- Follow the guidelines at
https://github.com/kubernetes/community/blob/master/contributors/guide/release-notes.md.
-->

```release-note
[dashboard] add External IPs tab with `Service` resources of type `LoadBalancer`
```

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **New Features**
* Added External IPs menu item in the Administration section for quick
access to load balancer services
* Introduced a new dashboard view displaying external IPs with tabbed
interface for enhanced visibility

<sub>✏️ Tip: You can customize this high-level summary in your review
settings.</sub>

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Signed-off-by: Andrei Kvapil <[email protected]>
The cozystack-operator's manager cache is filtered to only include
specific secrets and namespaces with certain labels. This caused
telemetry collection to fail because resources like kube-system
namespace, nodes, services, and PVs were not in the cache.

Switch to using mgr.GetAPIReader() which bypasses the cache and
queries the API server directly. This is appropriate for telemetry
since it only runs every 15 minutes.

Co-Authored-By: Claude <[email protected]>
Signed-off-by: Andrei Kvapil <[email protected]>
## What this PR does

This patch enables the `offline_access` scope for the dashbord keycloak
client, so that users get a refresh token which gatekeeper can use to
automatically refresh an expiring access token. Also session timeouts
were increased.

### Release note

```release-note
[dashboard] Increase session timeouts, add the offline_access scope,
enable refresh tokens to improve the overall user experience when
working with the dashboard.
```

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Chores**
* Updated authentication configuration with additional OAuth2 scope
parameters to enhance security credentials handling.
* Enhanced Keycloak client configuration with optional client scopes and
session management attributes, including logout redirect settings and
session timeout controls for improved session lifecycle management.

<sub>✏️ Tip: You can customize this high-level summary in your review
settings.</sub>

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## What this PR does

Fixes telemetry collection in cozystack-operator which was failing
because the manager's cache is filtered and doesn't include resources
needed for telemetry (kube-system namespace, nodes, services, PVs).

Switches to using `mgr.GetAPIReader()` which bypasses the cache.

### Release note

```release-note
[system] Fix telemetry collection in cozystack-operator
```

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

## Release Notes

* **Chores**
* Updated Docker image versions from 1.5.0 to 1.6.1 for platform
migrations and testing environments.
* Enhanced telemetry collection system with improved data access
patterns.

<sub>✏️ Tip: You can customize this high-level summary in your review
settings.</sub>

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Add missing changelog documentation for recent patch releases.

Co-Authored-By: Claude <[email protected]>
Signed-off-by: Andrei Kvapil <[email protected]>
….3 (cozystack#1922)

## What this PR does

Add missing changelog documentation for recent patch releases that were
released without changelog entries.

### Release note

```release-note
[docs] Add changelog documentation for v0.40.3, v0.41.1, v0.41.2, v0.41.3
```
@dosubot dosubot Bot added the size/L This PR changes 100-499 lines, ignoring generated files label Jan 27, 2026
@coderabbitai

coderabbitai Bot commented Jan 27, 2026

Copy link
Copy Markdown
Contributor

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

  • 🔍 Trigger a full review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@dosubot dosubot Bot added the kind/feature Categorizes issue or PR as related to a new feature label Jan 27, 2026
@themoriarti
Marian Koreniuk (themoriarti) merged commit 1354ba4 into cozystack:69-integration-with-proxmox-paas-proxmox-bundle Jan 27, 2026
9 checks passed
@gemini-code-assist

Copy link
Copy Markdown
Contributor

Summary of Changes

Hello Marian Koreniuk (@themoriarti), I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request introduces foundational changes aimed at enhancing the platform's capabilities, potentially in preparation for a Proxmox PAAS integration as indicated by the title. Key modifications include refining the telemetry data collection mechanism to ensure access to non-cached, up-to-date resource information, and significant improvements to the dashboard UI for better visibility and management of Kubernetes LoadBalancer services. The changes also standardize resource labeling for Kubernetes components, update Keycloak client configurations for improved authentication, and incorporate several dependency updates and recent bug fixes and improvements documented in new changelog entries. These updates collectively contribute to improved system observability, manageability, and security.

Highlights

  • Telemetry Data Collection Improvement: The telemetry collector now utilizes a non-cached API reader (mgr.GetAPIReader()) instead of the cached client (mgr.GetClient()) to fetch resources like the kube-system namespace and nodes. This ensures that telemetry data is collected from the most current state, bypassing potential filtering in the manager's cache.
  • Dashboard Enhancements for External IPs: A new 'External IPs' sidebar entry and a corresponding factory have been introduced in the dashboard. This enhancement provides improved visibility and management capabilities for Kubernetes LoadBalancer services, allowing users to easily view and interact with these resources.
  • Standardized Kubernetes Resource Labeling: Standardized application and tenant resource labels (apps.cozystack.io/application.* and internal.cozystack.io/tenantresource) have been added to Kubernetes cloud-config, Ingress, and Service resources. This improves resource organization, tracking, and consistency across the platform.
  • Keycloak Client Configuration Update: The Keycloak client configuration has been updated to include the offline_access scope and define specific session idle and maximum lifespan attributes. These changes enhance authentication flows and provide better control over user session management.
  • Dependency Updates and Changelog Additions: The cozyhr dependency has been updated to version 1.6.1 in relevant Dockerfiles. Additionally, several new changelog files (v0.40.3.md, v0.41.1.md, v0.41.2.md, v0.41.3.md) have been added, documenting recent fixes and improvements across various platform components.

🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature Command Description
Code Review /gemini review Performs a code review for the current pull request in its current state.
Pull Request Summary /gemini summary Provides a summary of the current pull request in its current state.
Comment Gemini (@gemini-code-assist) Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help /gemini help Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on Gemini (@gemini-code-assist) comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Footnotes

  1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

@gemini-code-assist gemini-code-assist Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request integrates a variety of changes, seemingly from a fork, that enhance dashboard functionality, update dependencies, and apply several fixes. Key additions include a new 'External IPs' view in the dashboard to display LoadBalancer services and improved labeling for tenant resources. The telemetry collector is now correctly configured to use a non-cached client, which should resolve issues with accessing cluster-wide resources.

My review has identified a couple of areas for improvement:

  • A security concern regarding the use of wget | sh in a Dockerfile, which could be vulnerable to a man-in-the-middle attack.
  • An opportunity to improve configurability by avoiding hardcoded session timeout values in a Keycloak client template.

Overall, the changes are positive, but addressing the identified points will improve the security and maintainability of the codebase. The pull request title and description are a bit confusing and don't seem to accurately reflect the content of the changes.

FROM alpine:3.22

RUN wget -O- https://github.com/cozystack/cozyhr/raw/refs/heads/main/hack/install.sh | sh -s -- -v 1.5.0
RUN wget -O- https://github.com/cozystack/cozyhr/raw/refs/heads/main/hack/install.sh | sh -s -- -v 1.6.1

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

security-high high

Piping the output of wget directly to sh is a security risk. The script is downloaded and executed without any integrity check. If the source at https://github.com/cozystack/cozyhr were to be compromised, or if a man-in-the-middle attack occurred, this could lead to arbitrary code execution within your build environment.

It is strongly recommended to adopt a safer pattern:

  1. Download the script to a file.
  2. Verify the file's checksum (e.g., SHA256) against a known-good value.
  3. Execute the script only if the checksum matches.

An even better approach would be to use a versioned binary release of cozyhr if one is available.

Comment on lines +73 to +74
client.session.idle.timeout: "86400"
client.session.max.lifespan: "604800"

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

The session idle timeout and max lifespan for the Keycloak client are hardcoded. This reduces flexibility for administrators who might need to enforce different session policies based on their environment's security requirements. It's a good practice to make these values configurable through the chart's values.yaml.

    client.session.idle.timeout: {{ index .Values._cluster "dashboardClientSessionIdleTimeout" | default "86400" | quote }}
    client.session.max.lifespan: {{ index .Values._cluster "dashboardClientSessionMaxLifespan" | default "604800" | quote }}

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

kind/feature Categorizes issue or PR as related to a new feature size/L This PR changes 100-499 lines, ignoring generated files

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants