Repository navigation
Conversation
The platform now carries whether the root Tenant runs ingress-nginx, and tenant-root's applications read it to decide whether to wait for ingress-nginx and whether to create their Ingress objects. Nothing ties the value to Tenant/root spec.ingress, so operators need to know to set it. Assisted-by: LLM Signed-off-by: Alexey Artamonov <aleksei.artamonov@aenix.io>
✅ Deploy Preview for cozystack ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
Contributor
|
Important Draft PR not reviewedDraft PRs are not automatically reviewed by default.
To automatically review draft PRs, update your CodeRabbit configuration: reviews:
auto_review:
drafts: true
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. |
1 of 12 tasks
Aleksei Sviridkin (lexfrei)
added a commit
to cozystack/cozystack
that referenced
this pull request
Nov 12, 2026
… has none (#5226) ## What this PR does Enabling SeaweedFS on the root tenant without ingress no longer hangs. `cozystack-basics` wrote `_namespace.ingress: tenant-root` for the root tenant whatever its `spec.ingress` said, so `seaweedfs-system` depended on an `ingress-nginx-system` release that nothing creates, and the platform backup bucket waited with it. Every other tenant already derives the key in `packages/apps/tenant/templates/namespace.yaml` and leaves it empty without ingress. `cozystack-basics` cannot read the root Tenant, so the platform now carries its ingress state the same way it carries monitoring: the new platform value `ingress.rootEnabled` reaches the `cozystack-values` Secret as `_cluster.ingress-enabled`, and `_namespace.ingress` is written only when it is true. The default is `true`, which keeps the value every existing cluster renders today, and a Secret written before the key existed keeps it as well. An operator running the root tenant without ingress sets `ingress.rootEnabled: false`, kept in sync with `Tenant/root spec.ingress` by hand, as with `monitoring.rootEnabled`. With the key empty, `seaweedfs-system` drops the dependency through the check it already had (`eq $ingress .Release.Namespace`), and nothing reads live cluster state for it. An empty `_namespace.ingress` now reaches tenant-root and every tenant inheriting from it, so the consumers that would break on it are adjusted in the same PR. The API rejects `ingressClassName: ""` (checked with a server-side dry run), and two consumers quote the value: - `kubernetes`: the proxied ingress-nginx addon Ingress is not rendered without an ingress; its Service still is. - `monitoring`: Grafana's `spec.ingress` is left out, since grafana-operator copies it into the Ingress verbatim. - `seaweedfs`: the S3 Ingress is disabled instead of rendering with no controller to serve it. The `KamajiControlPlane` `network.ingress` block is unchanged on purpose: its `hostname` is what the Kamaji provider uses as the control plane endpoint, and Kamaji itself skips an empty class name. Harbor, bucket, bootbox and alerta write the class unquoted, so an empty value renders as an unset class, which the API accepts. Tests: `packages/core/platform/tests/apps_ingress_enabled_wiring_test.yaml` pins the flag reaching `_cluster` both ways and with `ingress` set to null; `packages/system/cozystack-basics/tests/cozystack-values-secret_test.yaml` pins `_namespace.ingress` for a missing, string, bool and `"false"` flag, and that the other keys stay when ingress is off; `packages/extra/seaweedfs/tests/ingress_dependency_test.yaml` pins the dependency and the S3 Ingress for an own, empty and inherited ingress; the kubernetes and monitoring suites pin the gated Ingress. Reverting any of the gates, or flipping the missing-key default, fails the suites. Not covered here: - `_namespace.etcd` has the same hardcoded shape (#4783) and is left for its own change. - Toggling `Tenant/root spec.ingress` without changing `ingress.rootEnabled` leaves the value stale, as `monitoring.rootEnabled` does today. ### Screenshots Not a UI change. ### Downstream repositories The diff adds a key to `packages/core/platform/values.yaml`, which the website documents by hand. - [ ] No downstream repository is affected by this change - [x] [cozystack/website](https://github.com/cozystack/website) - follow-up: cozystack/website#800 documents `ingress.rootEnabled` in the platform Package reference - [ ] [cozystack/terraform-provider-cozystack](https://github.com/cozystack/terraform-provider-cozystack) - follow-up: - [ ] [cozystack/ansible-cozystack](https://github.com/cozystack/ansible-cozystack) - follow-up: - [ ] [cozystack/ccp](https://github.com/cozystack/ccp) - follow-up: - [ ] [cozystack/talm](https://github.com/cozystack/talm) - follow-up: - [ ] [cozystack/cozyhr](https://github.com/cozystack/cozyhr) - follow-up: - [ ] [cozystack/cozy-proxy](https://github.com/cozystack/cozy-proxy) - follow-up: - [ ] [cozystack/cozystack-telemetry-server](https://github.com/cozystack/cozystack-telemetry-server) - follow-up: - [ ] [cozystack/external-apps-example](https://github.com/cozystack/external-apps-example) - follow-up: - [ ] [cozystack/examples](https://github.com/cozystack/examples) - follow-up: - [ ] [cozystack/community](https://github.com/cozystack/community) - follow-up: ### Release note ```release-note fix(platform): a root tenant without ingress no longer leaves seaweedfs-system waiting for an ingress-nginx-system release that is never created. Set the new platform value ingress.rootEnabled to false to match Tenant/root spec.ingress: false. ``` <!-- This is an auto-generated comment: release notes by coderabbit.ai --> <!-- coderabbit-ai-generated:v1 --> ## Summary by CodeRabbit * **New Features** * Added a root-tenant ingress setting, enabled by default, that can be turned off. * **Bug Fixes** * Kubernetes and Grafana ingress resources are now rendered only when ingress is configured. * SeaweedFS S3 ingress is enabled only when ingress is configured. * Ingress-dependent components now respect the root-tenant setting, while other platform services remain available when root ingress is off. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this PR does
Documents the new platform value
ingress.rootEnabledfrom cozystack/cozystack#5226 in the platform Package reference. It records whether the root Tenant runs its own ingress-nginx, and nothing ties it toTenant/root spec.ingress, so operators running the root tenant without ingress need to know to set it tofalse.Kept as a draft until cozystack/cozystack#5226 is merged.