Repository navigation
docs: add v1.6 to v1.7 upgrade notes and bring Gateway API, Backup Classes and Platform Package up to 1.7 - #757
Open
myasnikovdaniil wants to merge 6 commits into
Open
myasnikovdaniil wants to merge 6 commits into
myasnikovdaniil wants to merge 6 commits into
Conversation
The page still described pre-1.7 behaviour as fact. TLS-passthrough hostnames are now reserved by the TenantGateway spec alone (cozystack/cozystack#3342, #4638): under HTTP-01 such a name gets no HTTPS listener and no certificate, route or no route, and a hostname only a TLSRoute claims earns neither. The three platform passthrough listeners render only on the publishing tenant, while gateway.enabled is on, for the names publishing.exposedServices lists, so a removed service loses its listener as well. The listener budget, the HTTP-01 listener layout and the rate-limit note are corrected to match. The route hostname policy now requires a non-empty spec.hostnames (cozystack/cozystack#3475) and has a third policy for GRPCRoute (cozystack/cozystack#3872). The Layer 5 text, the diagram label and the troubleshooting entry, whose quoted message changed, follow. Adds a section for TenantGateway tlsPassthroughListeners, the native-port passthrough form from #3342. Assisted-By: LLM Signed-off-by: Myasnikov Daniil <[email protected]>
Four platform values that 1.7 adds had no row on the Platform Package reference: - authentication.oidc.realmName (cozystack/cozystack#4237), with the character rule, the refusal of `master` and what a rename on a live cluster does. The keycloakInternalUrl row is corrected next to it: its default is now unset and derived from the realm name. - networking.encryption.enabled (cozystack/cozystack#2984), with the variants that apply, refuse or ignore it. - backupStrategyController, the pass-through that sizes the Redis backup strategy Pod. - kubernetesWorkerImage (cozystack/cozystack#4171), the values of the opt-in golden worker image catalog. cozystackOperator.systemNamespaceMemoryLimit is an installer value, not a platform one, so it is not part of this page. Assisted-By: LLM Signed-off-by: Myasnikov Daniil <[email protected]>
The website copy of the Backup Classes page had drifted from docs/operations/backup-classes.md in cozystack/cozystack. It listed seven applications and none of the drivers 1.7 adds. The body now follows the product page at v1.7.0-rc.1: - MongoDB (cozystack/cozystack#3562, #3967), Kafka topic metadata (#4000), RabbitMQ definitions (#3990) and Redis (#3992) bound by cozy-default, with their endpoint forms, credentials keys, storage flows and restore semantics. - The corrected PostgreSQL point-in-time recovery text from cozystack/cozystack#4443: base-backup selection, the recoverable window bounded by the last archived transaction, the one-second margin after stoppedAt, and archives with several timelines. This covers the corrections listed in #716. - Password handling after a restore, the default-objects gate and its metrics, the backupStrategyController override, concurrent restores and the Barman Cloud plugin upgrade notes. Adapted to the site: front matter and See also kept, relative links to the monorepo turned into GitHub links, `users[].password` written as the map path `users.<name>.password` the charts use, a test-run remark and the stale CloudNativePG version in the plugin note dropped. Assisted-By: LLM Signed-off-by: Myasnikov Daniil <[email protected]>
The docs had no page for moving between v1.x releases; the actions a v1.7 upgrade needs lived only in the release notes. Adds "Upgrading from v1.6 to v1.7" next to the generic upgrade procedure, which now points to it. The page names 1.7 in its title and path, so it stays correct once the trunk is promoted to v1.7 and copied again later. It covers the platform migrations 54 to 59 and the default variant, which runs none of them; the drbd_transport_tcp module Talos v1.14 needs before a node is upgraded, and the etcd metrics port; worker pools as KubernetesNodes resources, the FluxCD addon removal and the Kamaji update with its extraArgs refusals; the Cilium address block, Multus CNI plugin staging and the Gateway API route and passthrough changes; KubeVirt eviction and declarative hotplug; Redis, PostgreSQL and OpenSearch exposure rules, generated database passwords, FoundationDB 7.1, the Kafka KRaft migration and the SeaweedFS volume size limit; and the smaller breaking changes. Every statement was checked against cozystack/cozystack at v1.7.0-rc.1. The listing commands were run against local fixtures. Assisted-By: LLM Signed-off-by: Myasnikov Daniil <[email protected]>
✅ Deploy Preview for cozystack ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
Contributor
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars. ⚙️ Run configuration
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
The upgrade notes said the pool adoption changes the bootstrap template of each MachineDeployment, without saying why or that this is intended. v1.7 names each pool's TalosConfigTemplate after a hash of its content (cozystack/cozystack#3523), so every pool's MachineDeployment refers to a new template and Cluster API rolls the Talos workers once. The page now states the roll as expected, one-time behaviour with that cause and the rollout strategy, asks to plan the window for it, and notes that the same roll brings stale machine configuration up to date and gives GPU pools their NVIDIA kernel modules. The pre-upgrade checklist gains an entry for it. Assisted-By: LLM Signed-off-by: Myasnikov Daniil <[email protected]>
myasnikovdaniil
marked this pull request as ready for review
October 16, 2026 09:48
myasnikovdaniil
requested review from
Andrei Kvapil (kvaps),
Timofei Larkin (lllamnyp) and
Timur Tukaev (tym83)
as code owners
October 16, 2026 09:48
Instances with a memory limit below 512Mi and no explicit shared_buffers get a new default that needs a PostgreSQL restart, unless the cluster already runs v1.6.5. Signed-off-by: Myasnikov Daniil <[email protected]> Assisted-by: LLM
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This prepares
next/for the 1.7 promotion, which copies the trunk intov1.7/as is.Gateway API page described pre-1.7 behaviour. TLS-passthrough hostnames are now reserved by the TenantGateway spec alone (cozystack/cozystack#3342, #4638): under HTTP-01 such a name gets no HTTPS listener and no certificate, and the three platform passthrough listeners render only on the publishing tenant. Tenant routes must declare
spec.hostnames(#3475), and GRPCRoute is covered by its own policy (#3872). The page says so now and documentstlsPassthroughListeners. I also removed one sentence about the Cloudflare Tunnel package from it, the package doesn't ship in 1.7.There was no page for upgrading between v1.x releases. "Upgrading from v1.6 to v1.7" sits next to the generic upgrade procedure. It lists pre-upgrade checks, platform migrations 54 to 59 (the
defaultvariant runs none of them) and every breaking change with the action it needs:drbd_transport_tcpfor Talos v1.14, worker pools asKubernetesNodes, FluxCD addon removal, Kamaji andextraArgs, Cilium address block, Multus CNI staging, KubeVirt eviction and declarative hotplug, Redis, PostgreSQL and OpenSearch exposure, generated database passwords, FoundationDB 7.1, Kafka KRaft migration and SeaweedFS volume size limit. I checked each statement against v1.7.0-rc.1 code, and where the draft release notes and the code disagree the page follows the code.The page tells operators to plan for a one-time roll of Talos workers in every existing tenant cluster.
TalosConfigTemplateis now named by a content hash (cozystack/cozystack#3523), so each pool gets a new template and Cluster API replaces its workers. No action is needed on the pools, but data on a worker's own system disk (local-path volumes, for example) doesn't survive the replacement.Backup Classes is re-synced with the product doc: MongoDB, Kafka, RabbitMQ and Redis drivers and the corrected PostgreSQL point-in-time recovery text (covers #716 for
next/).Platform Package reference gets
authentication.oidc.realmName,networking.encryption.enabled,backupStrategyControllerandkubernetesWorkerImage. I also fixed thekeycloakInternalUrlrow, it contradicted the newrealmNamerow.Checked locally: Hugo 0.164.0 preview build, refs and in-page anchors, i18n checks.