Repository navigation
docs(release): add changelog for v1.4.0 - #2675
Conversation
Signed-off-by: Myasnikov Daniil <[email protected]>
myasnikovdaniil
added
kind/documentation
Summary of ChangesHello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request introduces the official changelog documentation for the Cozystack v1.4.0 release. It provides a detailed overview of the significant platform enhancements, including the new dashboard UI, persistent worker node storage, instance-type resource presets, and declarative backup strategies, alongside critical dependency updates and bug fixes. Highlights
New Features🧠 You can now enable Memory (public preview) to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console. Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize the Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counterproductive. You can react with 👍 and 👎 on Gemini (@gemini-code-assist) comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here. Footnotes
|
github-actions
Bot
added
size/L
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
✅ Files skipped from review due to trivial changes (1)
📝 WalkthroughWalkthroughThis PR adds the v1.4.0 release changelog documenting feature highlights, upgrade notes, platform component updates, major improvements, bug fixes, security/configuration notes, dependency updates, documentation changes, and contributor acknowledgements. Changesv1.4.0 Release Changelog
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~2 minutes Suggested labels
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces the comprehensive changelog for Cozystack v1.4.0, detailing major updates such as the new schema-driven dashboard UI, persistent worker node storage, and a cloud-style resource preset taxonomy. Feedback from the review identifies several typos in CVE identifiers and feature gate names that need correction. Additionally, the PR violates repository style guidelines regarding the PR title scope and the missing mandatory release-note block in the description.
| @@ -0,0 +1,358 @@ | |||
| <!-- | |||
There was a problem hiding this comment.
The pull request does not adhere to the repository's contribution guidelines:
- Invalid Scope: The PR title
docs(release): ...usesreleaseas a scope, which is not in the list of valid scopes defined in the Repository Style Guide (lines 40-45). Consider usingdocs(docs)ordocs(meta). - Missing Release Note: The PR description lacks the mandatory
release-noteblock required by the Repository Style Guide (lines 51-57).
There was a problem hiding this comment.
The docs(release): title and body match the CI-generated changelog PR exactly (see .github/workflows/tags.yaml lines 428-429, which creates the same PR automatically on tag push). release is a recognized scope: .github/workflows/pr-labeler.yaml maps it to area/release, and the scope list in docs/agents/contributing.md is explicitly non-exhaustive ("examples — not an exhaustive list; pick the most specific scope"). Changelog-bundling PRs ARE the release notes and do not carry an additional release-note block by repo convention.
|
|
||
| ## Platform Components | ||
|
|
||
| * **Talos**: v1.12.7 → v1.13.0 (v1.12.7 was the final v1.3.x step, shipped in v1.3.2 via #2547 for CVE-2026-31431). v1.13.0 ships a Clang-built kernel with ThinLTO optimization, enables Container Device Interface by default for dynamic device-spec files under `/run/cdi`, adds a new `talosctl debug` subcommand for attaching to privileged debug containers, introduces the `EnvironmentConfig` document that replaces and deprecates `.machine.env`, adds virtiofs-based external volumes via `ExternalVolumeConfig`, machine-wide container-image signature verification via `ImageVerificationConfig`, and a new `LifecycleService` API for programmatic installs and upgrades. Component updates: Linux 6.18.24, containerd 2.2.3, etcd 3.6.9, CoreDNS 1.14.2, Kubernetes 1.36.0, CNI 1.9.1, runc 1.4.2, systemd 259.5. Built with Go 1.26.2. ([release notes](https://github.com/siderolabs/talos/releases/tag/v1.13.0)) ([**@kvaps**](https://github.com/kvaps) in #2546) |
There was a problem hiding this comment.
Typo in CVE ID: CVE-2026-31431 should be CVE-2024-31431 to correctly reference the vulnerability fixed in Talos v1.12.7.
| * **Talos**: v1.12.7 → v1.13.0 (v1.12.7 was the final v1.3.x step, shipped in v1.3.2 via #2547 for CVE-2026-31431). v1.13.0 ships a Clang-built kernel with ThinLTO optimization, enables Container Device Interface by default for dynamic device-spec files under `/run/cdi`, adds a new `talosctl debug` subcommand for attaching to privileged debug containers, introduces the `EnvironmentConfig` document that replaces and deprecates `.machine.env`, adds virtiofs-based external volumes via `ExternalVolumeConfig`, machine-wide container-image signature verification via `ImageVerificationConfig`, and a new `LifecycleService` API for programmatic installs and upgrades. Component updates: Linux 6.18.24, containerd 2.2.3, etcd 3.6.9, CoreDNS 1.14.2, Kubernetes 1.36.0, CNI 1.9.1, runc 1.4.2, systemd 259.5. Built with Go 1.26.2. ([release notes](https://github.com/siderolabs/talos/releases/tag/v1.13.0)) ([**@kvaps**](https://github.com/kvaps) in #2546) | |
| * **Talos**: v1.12.7 → v1.13.0 (v1.12.7 was the final v1.3.x step, shipped in v1.3.2 via #2547 for CVE-2024-31431). v1.13.0 ships a Clang-built kernel with ThinLTO optimization, enables Container Device Interface by default for dynamic device-spec files under `/run/cdi`, adds a new `talosctl debug` subcommand for attaching to privileged debug containers, introduces the `EnvironmentConfig` document that replaces and replaces and deprecates `.machine.env`, adds virtiofs-based external volumes via `ExternalVolumeConfig`, machine-wide container-image signature verification via `ImageVerificationConfig`, and a new `LifecycleService` API for programmatic installs and upgrades. Component updates: Linux 6.18.24, containerd 2.2.3, etcd 3.6.9, CoreDNS 1.14.2, Kubernetes 1.36.0, CNI 1.9.1, runc 1.4.2, systemd 259.5. Built with Go 1.26.2. ([release notes](https://github.com/siderolabs/talos/releases/tag/v1.13.0)) ([**@kvaps**](https://github.com/kvaps) in #2546) |
There was a problem hiding this comment.
The CVE ID is correct. The original Talos bump PR #2545 carries CVE-2026-31431 in its title, body, and release-note block, and the Siderolabs blog at siderolabs.com/blog/exploit-fail-cve-2026-31431-copy-fail-barely-scratches-talos-linux uses the same identifier. CVE-2024-31431 is unrelated.
|
|
||
| * **[security] Bump Go dependencies to clear Dependabot CVE alerts**: Bumps root module Go deps to latest, kubeovn-webhook, kubevirt-csi-driver, token-proxy, and `api/apps/v1alpha1` deps, plus the OpenTelemetry exporter modules to align with the otel core; first-party Dockerfile builders are bumped to `golang:1.26`, and the first-party scratch images now run as non-root UID 65532. `USER 65532` is dropped from `cozystack-api` and `lineage-controller-webhook` containers in favor of the OCI-level UID so it can be overridden by PodSecurityContext ([**@lexfrei**](https://github.com/lexfrei) in #2494). | ||
|
|
||
| * **[talos] Bump Talos to v1.12.7 (CVE-2026-31431)**: See Platform Components — picks up the kernel fix for the "Copy Fail" local privilege escalation in `algif_aead` *(backported to v1.3.2 via #2547)* ([**@kvaps**](https://github.com/kvaps) in #2545). |
There was a problem hiding this comment.
Typo in CVE ID: CVE-2026-31431 should be CVE-2024-31431.
| * **[talos] Bump Talos to v1.12.7 (CVE-2026-31431)**: See Platform Components — picks up the kernel fix for the "Copy Fail" local privilege escalation in `algif_aead` *(backported to v1.3.2 via #2547)* ([**@kvaps**](https://github.com/kvaps) in #2545). | |
| * **[talos] Bump Talos to v1.12.7 (CVE-2024-31431)**: See Platform Components — picks up the kernel fix for the "Copy Fail" local privilege escalation in `algif_aead` *(backported to v1.3.2 via #2547)* ([**@kvaps**](https://github.com/kvaps) in #2545). |
There was a problem hiding this comment.
Same as the other thread: CVE-2026-31431 is the actual identifier used by Siderolabs and by the original bump PR #2545. No change needed.
|
|
||
| * **KubeVirt**: v1.6.3 → v1.8.2. Two-minor jump crossing the upstream QEMU bump — VMs running before the upgrade need a cold restart (see Upgrade Notes). New CRD fields for changed block tracking (storage-agnostic incremental backups), `s390x` support added, `ppc64le` deprecated. The standalone ServiceMonitor / alerts templates are removed in favour of the Helm-rendered PrometheusRule. ([v1.7.0 notes](https://github.com/kubevirt/kubevirt/releases/tag/v1.7.0), [v1.8.0 notes](https://github.com/kubevirt/kubevirt/releases/tag/v1.8.0)) ([**@IvanHunters**](https://github.com/IvanHunters) in #2502) | ||
| - **VM Backup API + Changed Block Tracking** — new alpha `VMBackup` resource and `ChangedBlockTracking` matcher on `KubeVirt` enable storage-agnostic incremental backups; CBT also applies to hotplug volumes; libvirt checkpoints survive VM restart for resumable incremental flows. | ||
| - **Confidential VMs (experimental)**: Intel TDX support behind the `WorkloadEncryptionTDX` feature gate, AMD SEV-SNP behind `WorkloadEncruptionSEV` (alongside the existing SEV/SEV-ES paths). |
There was a problem hiding this comment.
Typo in the feature gate name: WorkloadEncruptionSEV should be WorkloadEncryptionSEV.
| - **Confidential VMs (experimental)**: Intel TDX support behind the `WorkloadEncryptionTDX` feature gate, AMD SEV-SNP behind `WorkloadEncruptionSEV` (alongside the existing SEV/SEV-ES paths). | |
| - **Confidential VMs (experimental)**: Intel TDX support behind the `WorkloadEncryptionTDX` feature gate, AMD SEV-SNP behind `WorkloadEncryptionSEV` (alongside the existing SEV/SEV-ES paths). |
There was a problem hiding this comment.
Fixed in 025f4e4. Verified against upstream source: the actual feature gate in kubevirt/kubevirt:pkg/virt-config/featuregate/active.go is WorkloadEncryptionSEV. The misspelling came from quoting the v1.7.0 release-notes text verbatim — corrected to match the real gate name so users can copy-paste it.
|
|
||
| * **[docs/operations] Resource presets reference**: New `docs/operations/resource-presets.md` in-repo doc documenting the new five-series taxonomy and the legacy alias mapping ([**@lexfrei**](https://github.com/lexfrei) in #2607). | ||
|
|
||
| * **[talm] Release v0.25.0, v0.25.1, v0.26.0, v0.26.1, v0.27.0, v0.28.0, v0.28.1, v0.28.2** (github.com/cozystack/talm): The talm CLI gains apply-time safety gates (declared-resource existence + drift preview/verify), a wrapper UX overhaul (persistent flags, `-n` drop, crashdump, kubeconfig hint, dmesg cushion, TUI refusal), META preservation by default on `talm reset`, a pre-flight Talos version check on `apply`, multi-NIC discovery for chart defaults (filtered to IPv4 family, longest-prefix VIP-link matching), strict golangci-lint config + cross-platform CI gates, `--image` flag on `init`, cluster-name overrides via `dislogical`, and a handful of charts/engine fixes (RotateKeys atomic rotation, IPv6 bracket normalisation, `$patch:delete` no-op on absent paths). Notable PRs: ([**@lexfrei**](https://github.com/lexfrei) in cozystack/talm#127, #128, #129, #130, #133, #135, #136, #145, #146, #149, #150, #154, #158, #160, #161, #162, #163, #173, #197, #199, #200, #201, #202; [**@dislogical**](https://github.com/dislogical) in cozystack/talm#148). |
There was a problem hiding this comment.
For consistency with other contributor mentions in this document, consider using the formatted username for @dislogical.
| * **[talm] Release v0.25.0, v0.25.1, v0.26.0, v0.26.1, v0.27.0, v0.28.0, v0.28.1, v0.28.2** (github.com/cozystack/talm): The talm CLI gains apply-time safety gates (declared-resource existence + drift preview/verify), a wrapper UX overhaul (persistent flags, `-n` drop, crashdump, kubeconfig hint, dmesg cushion, TUI refusal), META preservation by default on `talm reset`, a pre-flight Talos version check on `apply`, multi-NIC discovery for chart defaults (filtered to IPv4 family, longest-prefix VIP-link matching), strict golangci-lint config + cross-platform CI gates, `--image` flag on `init`, cluster-name overrides via `dislogical`, and a handful of charts/engine fixes (RotateKeys atomic rotation, IPv6 bracket normalisation, `$patch:delete` no-op on absent paths). Notable PRs: ([**@lexfrei**](https://github.com/lexfrei) in cozystack/talm#127, #128, #129, #130, #133, #135, #136, #145, #146, #149, #150, #154, #158, #160, #161, #162, #163, #173, #197, #199, #200, #201, #202; [**@dislogical**](https://github.com/dislogical) in cozystack/talm#148). | |
| * **[talm] Release v0.25.0, v0.25.1, v0.26.0, v0.26.1, v0.27.0, v0.28.0, v0.28.1, v0.28.2** (github.com/cozystack/talm): The talm CLI gains apply-time safety gates (declared-resource existence + drift preview/verify), a wrapper UX overhaul (persistent flags, `-n` drop, crashdump, kubeconfig hint, dmesg cushion, TUI refusal), META preservation by default on `talm reset`, a pre-flight Talos version check on `apply`, multi-NIC discovery for chart defaults (filtered to IPv4 family, longest-prefix VIP-link matching), strict golangci-lint config + cross-platform CI gates, `--image` flag on `init`, cluster-name overrides via **@dislogical**, and a handful of charts/engine fixes (RotateKeys atomic rotation, IPv6 bracket normalisation, `$patch:delete` no-op on absent paths). Notable PRs: ([**@lexfrei**](https://github.com/lexfrei) in cozystack/talm#127, #128, #129, #130, #133, #135, #136, #145, #146, #149, #150, #154, #158, #160, #161, #162, #163, #173, #197, #199, #200, #201, #202; [**@dislogical**](https://github.com/dislogical) in cozystack/talm#148). |
There was a problem hiding this comment.
Fixed in 0ca1014 using the linked-contributor format [**@dislogical**](https://github.com/dislogical) that the rest of the changelog uses for contributor mentions.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/changelogs/v1.4.0.md`:
- Around line 102-103: Replace the misspelled KubeVirt feature gate name
`WorkloadEncruptionSEV` with the correct `WorkloadEncryptionSEV` in the
changelog entry so users can copy-paste the exact feature flag; update the
second bullet where `WorkloadEncruptionSEV` appears (alongside
`WorkloadEncryptionTDX`) to the correct spelling.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 780307e7-fd63-4f39-a266-060c6a26a41b
📒 Files selected for processing (1)
docs/changelogs/v1.4.0.md
Address review feedback from gemini-code-assist on docs/changelogs/v1.4.0.md:102 and coderabbitai on :103: the AMD SEV-SNP feature gate in upstream KubeVirt source is WorkloadEncryptionSEV (see pkg/virt-config/featuregate/active.go), not WorkloadEncruptionSEV as quoted from the v1.7.0 release notes. Signed-off-by: Myasnikov Daniil <[email protected]>
Address review feedback from gemini-code-assist on docs/changelogs/v1.4.0.md:326: the in-prose mention of dislogical was rendered as inline code rather than as a contributor link. Switch to the [**@user**](https://github.com/user) format used elsewhere in the changelog. Signed-off-by: Myasnikov Daniil <[email protected]>
## What this PR does Follow-up to #2675. Fixes four broken references in `docs/changelogs/v1.4.0.md` that were caught by re-verifying every link in the merged changelog: | Where | Was | Now | |---|---|---| | Resource Presets doc link (Feature Highlights) | `cozystack.io/docs/operations/resource-presets/` (404) | `cozystack.io/docs/v1.4/guides/resource-management/` | | HAMi doc link (Feature Highlights) | `cozystack.io/docs/operations/kubernetes/hami/` (404) | `cozystack.io/docs/v1.4/kubernetes/gpu-sharing/` | | Upgrade notes — resource presets PR ref | `#2426` (`feat(monitoring): upgrade victoria-metrics-operator`) | `#2607` (`feat(apps): instance-type resource presets`) | | Upgrade notes — postgres parameters PR ref | `#2475` (unrelated open issue about bundle YAML) | `#2466` (`feat(postgres)!: support all PostgreSQL configuration parameters`) | The Feature Highlights / Major Features sections already cited #2607 and #2466 correctly; only the Upgrade Notes section pointed at the wrong PR numbers. ### Release note ```release-note NONE ``` <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Updated changelog documentation links to reflect new resource management guides location. * Refreshed HAMi compatibility references to point to current GPU-sharing documentation. * Updated related PR references in upgrade notes for accuracy. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/cozystack/cozystack/pull/2693?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai -->
%5D(https%3A%2F%2Fapp.coderabbit.ai%2Fchange-stack%2Fcozystack%2Fcozystack%2Fpull%2F2693%3Futm_source%3Dgithub_walkthrough%26amp%3Butm_medium%3Dgithub%26amp%3Butm_campaign%3Dchange_stack){kind=link}
2 participants
This PR adds the changelog for release
v1.4.0.✅ Changelog has been automatically generated in
docs/changelogs/v1.4.0.md.Summary by CodeRabbit