v1.6.3 (2026-09-03)

A patch release with a security fix restricting access to the kube-ovn admission webhook, four bug fixes covering managed Kubernetes, ClickHouse, PostgreSQL and telemetry, a reworked Marketplace/Admin dashboard, configurable ClickHouse versions, a WorkloadMonitor bucket-metrics endpoint override, a Keycloak KMS proxy update and Vault CA support, plus ansible-cozystack dependency bumps and a batch of new documentation.

Security

fix(kubeovn-webhook): restrict the webhook port to the API server: The kube-ovn-webhook /mutate-pods handler returned namespace-derived annotations to any caller that could reach its serving port, and nothing previously stopped an arbitrary in-cluster pod from being that caller. A CiliumNetworkPolicy now denies pod and world traffic to the webhook's port while allowing only the API server (which runs on the host network), closing the exposure tracked as GHSA-g883-q79m-8225 without needing the client-certificate path, which the platform's current admission configuration cannot use (@kvaps in #3955, backport #3975).

Features and Improvements

feat(dashboard): rework the Marketplace entry point and the Admin portal: The Console is now the dashboard's entry point instead of the Marketplace, so opening the dashboard shows what a tenant already runs rather than a "choose a product" landing page; the Marketplace opens the grouped application list directly, one click away. Administration (Tenants, Modules, External IPs, per-tenant Info) moves from Console into an always-visible Admin tab, while the two cluster-wide operator areas (Capacity, Backup Classes) keep their own gates. Tenants and Modules are now rendered as a tenant hierarchy tree instead of a flat table, so sub-tenants and inherited modules are visible instead of missing or erroring, and External IPs lists LoadBalancer services across every accessible tenant in one table. Secret values can be copied without being revealed on screen first (@kvaps in #3928, backport #3952).
feat(clickhouse): add configurable version parameter: The ClickHouse server and Keeper images were hardcoded to 24.9.2.42, so — unlike postgres, mariadb, mongodb, opensearch, rabbitmq and redis — ClickHouse instances carried no engine version in the Cozystack API. A version values key (v25.8, v25.3, v24.9, default v24.9 for byte-identical existing renders) now selects the server and Keeper image tags, with hack/update-versions.sh refreshing the supported-version map from Docker Hub (@scooby87 in #3476, backport #4054).
feat(workloadmonitor): bucket metrics endpoint override: cozystack-controller meters S3 bucket sizes for billing by discovering a VictoriaMetrics endpoint through a namespace label, which assumed the monitoring stack scraping SeaweedFS always runs in the same cluster. A new cozystackController.seaweedfsMetricsEndpoint chart value lets a deployment point bucket-size queries at a remote Prometheus-compatible endpoint instead, with no behavior change when unset. This also fixes a latent billing bug where any metrics-query failure silently zeroed out recorded bucket sizes; the controller now retains the last known values and surfaces the failure via a BucketMetricsUnavailable event and error metrics instead of wiping billing data (@lllamnyp in #3443, backport #3558).
feat(keycloak): let the KMS proxy trust a private Vault CA: The KMS-encrypting DB proxy could previously only reach a Vault whose certificate chains to a publicly trusted root, so a Vault behind an internal load balancer with a self-signed certificate was reachable only over plain HTTP. encryption.kms.vault now accepts a CA either inline as caBundle or via an existing caSecretName/caSecretKey, letting the proxy verify a private Vault over HTTPS; existing installations are unaffected when neither key is set (@sircthulhu in #3874, backport #3981).

Fixes

fix(postgres): let in-place restore re-bootstrap instead of wedging: An in-place PostgreSQL RestoreJob (restoring an app back into itself) never came back up — the cluster stayed in Setting up primary with crash-looping recovery pods, or the HelmRelease upgrade failed outright. Two independent bugs in the restore patch caused this: the restored cluster's WAL-archive serverName collided with the recovery source's, and useSystemBucket stayed enabled alongside explicit restore S3 coordinates, tripping the chart's own compatibility guard. Both are fixed, so in-place restores now re-bootstrap to a healthy cluster instead of wedging (@androndo in #3959, backport #3988).
fix(clickhouse): scheme the backup S3_ENDPOINT on the system-bucket flow: On the default useSystemBucket backup flow, the ClickHouse chart passed a scheme-less host straight into the clickhouse-backup sidecar's S3_ENDPOINT, which altinity/clickhouse-backup's AWS SDK endpoint resolver rejects outright — so every ClickHouse backup and restore on the default flow failed with was not a valid URI. The chart now prepends https:// on that path, matching how the platform already schemes the equivalent endpoint for other backup strategies, so default-flow ClickHouse backups and restores work again (@androndo in #3963, backport #3987).
fix(kubernetes): retry the tenant CNI install instead of uninstalling it: The tenant Cilium HelmRelease had no install strategy, so Flux used its default RemediateOnFailure, which uninstalls Cilium — the tenant cluster's only CNI — between retry attempts whenever the initial install ran long (for example while waiting for the first worker node to register), then reinstalls it on the next attempt, repeating without end. The strategy is now RetryOnFailure, which keeps the applied manifests in place and retries a failed install as an upgrade, so the CNI is no longer torn down and the agent DaemonSet rolls out as soon as a worker registers (@lexfrei in #3552, backport #4033).
fix(telemetry): make the documented opt-out cover both collectors: Telemetry is reported by two components — cozystack-operator and cozystack-controller — but only the operator had a reachable opt-out switch; the documented cozystackOperator.disableTelemetry setting could never reach the controller, which kept posting application counts every 15 minutes even after an operator followed the published opt-out procedure. The platform chart now threads a telemetry.disabled key into the controller as well, so the documented opt-out actually disables both collectors (@kvaps in #3791, backport #3916).

Dependencies

chore(keycloak): bump KMS proxy to 0.2.2: Updates keycloak-kms-proxy to v0.2.2 and pins the image to its published digest, fixing decryption for reads whose result set spans a join (@myasnikovdaniil in #3995, backport #3996).
[ansible-cozystack] chore(deps): update k3s to v1.36.3+k3s1 and v1.36.4+k3s1: Renovate dependency bumps of the k3s Kubernetes distribution used by the management-cluster bootstrap role (@app/renovate in cozystack/ansible-cozystack#66, #69).
[ansible-cozystack] chore(deps): track cozystack installer v1.6.2: Renovate dependency bump of the cozy-installer Docker image tag to follow the latest Cozystack patch release (@app/renovate in cozystack/ansible-cozystack#68).

Documentation

[website] fix(telemetry): document the opt-out for both collectors: Documents both opt-out steps now that the fix above threads telemetry.disabled through the platform, replacing the previously incomplete single-step procedure (@kvaps in cozystack/website#651).
[website] docs(home): refresh the screenshot gallery for the reworked console: Retakes the home-page screenshot gallery against the reworked console (Marketplace, Modules, Tenants, Admin), replacing slides that showed a header and sidebar layout that no longer exist (@kvaps in cozystack/website#662).
[website] docs(images): refresh the product screenshot and its dark variant: Retakes the standalone product screenshot referenced by the announcement post and outside links, which still showed a console two redesigns old (@kvaps in cozystack/website#663).
[website] feat(site): Live Demo — the real console, mocked, in the browser: Adds a /demo page running the real cozystack-ui console with a mocked Kubernetes API, so a visitor can explore the actual marketplace and console without a cluster, signup, or install (@tym83 in cozystack/website#669).
[website] feat(demo): self-refreshing console demo + Resources nav grouping: Adds the demo's source as an overlay with a weekly-refresh workflow so the mocked bundle tracks upstream cozystack-ui automatically, and groups secondary navigation links under a Resources menu (@tym83 in cozystack/website#670).
[website] fix(demo): embed console under site nav, fix refresh + deep create: Fixes the live demo breaking on a hard refresh of any deep route by serving the SPA at a separate path and embedding it in an iframe under a real Hugo page, and keeps the site's own navigation visible above the demo (@tym83 in cozystack/website#676).
[website] fix(demo): create works for every catalog type: Fixes demo creation hanging on an endless spinner for most marketplace types (Kubernetes cluster, FoundationDB, Harbor, MariaDB, and others) by resolving the mocked kind from the application catalog instead of a hardcoded list of seven types (@tym83 in cozystack/website#677).
[website] fix(page): render page title and fix top spacing on type:page pages: Fixes page titles not rendering and content sitting flush against the navbar on type: page pages, most visible on the Compliance section (@tym83 in cozystack/website#668).
[website] docs(virtualization): guide for building a Windows golden image with Packer: Adds a guide for building a Windows golden image with Packer on KubeVirt, covering the CDI clone flow and the published HashiCorp KubeVirt Packer plugin (@scooby87 in cozystack/website#666).
[website] docs(compliance): add Kubernetes conformance results page: Adds a Kubernetes conformance page documenting the platform's CNCF conformance runs, later extended with the v1.31 result and corrected submission scope (@tym83 in cozystack/website#658, #660).
[website] fix(blog): restore Community Meeting Calendar link in Wizard post: Fixes an empty link in the Wizard announcement blog post (@tym83 in cozystack/website#659).
[website] docs(faq): drop the retired GitOps example: Replaces a FAQ pointer to an archived, pre-1.0 GitOps example repository with a direct answer explaining that Cozystack applications are ordinary Kubernetes objects, so no platform-specific GitOps tooling is needed (@kvaps in cozystack/website#661).
[website] docs(licenses): list kuberture and ouroboros: Adds kuberture and ouroboros — both shipped with the platform and maintained by a Cozystack maintainer — to the Licenses page, which otherwise only enumerates upstream components (@kvaps in cozystack/website#649).

Contributors

Thanks to everyone who contributed to this patch release:

Full Changelog: v1.6.2...v1.6.3

cozystack/cozystack v1.6.3 on GitHub