feat!: pin the cozystack API with shared-central tracing and add tenant tracing_central

[scooby87]

Pull Request

Summary

Adds the tracing_central attribute to cozystack_tenant, so Terraform can put a tenant's traces into the shared VictoriaTraces store in tenant-root (cozystack/cozystack#3775 and cozystack/cozystack#4648).

Why this PR is larger than one attribute. No api/apps/v1alpha1 release tag contains the tracingCentral field yet, so the API module is pinned to the cozystack main commit that merged cozystack/cozystack#4648, the first one carrying both tracing changes. Any commit with the tracing field also carries everything merged to main before it, including four removals the provider still depended on. The provider would not build against the new pin without them, and it would keep sending fields a v1.7 cluster no longer defines. So this PR also contains exactly those mandatory adaptations, and nothing else: fields the new API adds and the provider does not need to change for are not modelled here.

Changes

• cozystack_tenant: new tracing_central attribute (default false, matching the chart schema), also on the data source.
• API pin moved from v1.6.3 to the cozystack main commit with the tracing field.
• Breaking: cozystack_httpcache (resource and data source) is removed. Cozystack removed the HTTPCache application and its ResourceDefinition.
• Breaking: cozystack_kubernetes loses node_groups and node_health_check. Worker pools moved to KubernetesNodes upstream, and the platform upgrade migrates existing groups into <cluster>-<pool> objects, which cozystack_kubernetes_nodes manages.
• Breaking: cozystack_kafka loses zookeeper. Cozystack runs Kafka in KRaft mode and migrates existing clusters on upgrade.
• Breaking: cozystack_postgres and cozystack_mariadb lose users[].password. Cozystack always generates user passwords now and ignores one set in the spec; the live password is in the postgres-<name>-credentials or mariadb-<name>-credentials Secret. New guards compare each user entry against the pinned User type, since the top-level guards could not see this.
• The spec-coverage guards list the optional fields the new API adds and this PR does not model in their omit lists, so each guard still fails on any other top-level field the API adds (the guards do not look inside nested blocks, so a nested field the API adds passes them): tenant gatewayClass and computeplane; kubernetes substrate, proxmox, controlPlane.kubelet, controlPlane.apiServer.admissionControllers and talos.registryMirrors; the new kubernetes-nodes pool fields; kafka version; tls on redis, mariadb, opensearch and rabbitmq; postgres autoscaling; harbor managementWhitelist; vm-instance firmware; vm-disk bindImmediately. They can be modelled one by one in follow-up PRs, together with the new Valkey kind, which the CHANGELOG lists as not covered.

The pin is a Go pseudo-version that sorts below v1.6.3, so it should be replaced by the first v1.7 tag of api/apps/v1alpha1 rather than bumped by a dependency bot: an automatic bump to a v1.6.x tag would drop the tracing field again. CLAUDE.md records this, and Renovate updates of the module are disabled until the tag pin returns. Removed attributes need no state migration: the framework drops attributes that are no longer in the schema when it reads existing state.

Testing

• Unit tests pass locally (make test)
• Linters pass locally (make lint)
• Generated docs are up to date (make docs produces no diff)
• Acceptance tests pass against a live cluster (make testacc), if applicable

Acceptance tests were not run: they need a cluster on the pinned API, and no released Cozystack carries it yet. The kubernetes, kafka, postgres and mariadb acceptance tests are updated for the removed attributes.

Documentation

• Examples added or updated under examples/ (if a resource/data source changed)
• Registry docs regenerated (make docs)
• CHANGELOG updated (if user-facing)

Checklist

• Commit messages follow semantic format (type(scope): description)
• No secrets or credentials in code or state
• Breaking changes documented (if any)

Additional Notes

The new tenant attribute was checked by mutation: breaking its expand, its flatten or its default each turns a unit test red.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: abdd59eb-5d0a-4eb4-b857-c1f786075314

---

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

---

_{Comment @coderabbitai help to get the list of available commands.}

[Aleksei Sviridkin (lexfrei)]

scooby87 NOT LGTM. The tracing_central attribute is correct, but the new pin removes one more field the provider still sends, and merging this before a v1.6.4 provider release leaves the v1.6 line with no way to ship.

Business context: Terraform users need a way to send a tenant's traces to the shared VictoriaTraces store in tenant-root. That needs the API pin moved past v1.6.3 and the provider adapted to everything the new pin removes.

Blockers

B1. Postgres and MariaDB user passwords are still writable, but the pinned API ignores them.

At 11499c30e cozystack dropped User.password from both api types (2b5877eff and 9f857f64e). Both chart schemas now say passwords are always generated and cannot be set from values, and a leftover password "is ignored by the render and draws an admission warning". The provider still offers users[].password as Optional with "autogenerated when omitted" (postgresql_schema.go:22, mariadb_schema.go:48). It writes the value into the spec and reads it back on flatten. On a v1.7 cluster a configured password is never applied, and every apply draws the warning. State and the data source show a password that is not the live one. The guards miss this because they only check top-level keys and users is a map. I'd remove password from both resources and data sources, or make it computed from the <release>-credentials Secret, and add a breaking entry to the CHANGELOG.

B2. Merge order against the v1.6 line.

Releases are cut by hand from tags, and the provider version follows the Cozystack API version (CLAUDE.md, CONTRIBUTING). The Unreleased section on master already waits "to ship with the first Cozystack API pin that contains cozystack/cozystack#3936". That pin exists now: api/apps/v1alpha1/v1.6.4 carries the backport (#4393). So today master can ship as provider v1.6.4 with only a pin bump. After this PR master can only ship as v1.7.x. There is no v1.7 api tag yet and no release-1.6 branch to fall back to.

A premature release from master would also hurt v1.6 users. Client.Update replaces the whole spec (internal/client/application.go:132), and the apiserver passes the spec to the HelmRelease as values. On a v1.6 cluster the next update of any cozystack_kubernetes sends no nodeGroups. The v1.6.4 chart then falls back to nodeGroups: {}, renders only the implicit md0, and prunes every other worker pool. cozystack_kafka loses its ZooKeeper sizing to chart defaults the same way. tracingCentral is harmless there, because the v1.6.4 tenant schema has no additionalProperties: false. The README and docs don't say which Cozystack versions a release supports, so nothing warns a user on >= 1.6.

What I'd do: cut provider v1.6.4 from current master first (pin api/apps/v1alpha1 v1.6.4), then merge this. The other option is to hold this until the v1.7 api tag exists and pin to it. A tag api/apps/v1alpha1/v1.7.0-alpha.3 would work too, because v1.7.0-alpha.3 already contains 11499c30e.

B3. CLAUDE.md now contradicts go.mod.

CLAUDE.md still says the api module "is pinned to a released tag (currently v1.6.3), never a pseudo-version", and the matching rule in renovate.json has the same description. Why this pin must be replaced by the first v1.7 tag, and not bumped, is written only in the PR body and one commit message. Please update the CLAUDE.md line to say the pin is a temporary pseudo-version and what replaces it. This matters already: api/apps/v1alpha1/v1.6.4 exists and sorts above the pin.

What I checked

• tracing_central defaults to false, same as values.schema.json and tenant.ConfigSpec at the pin. Expand, flatten and the data source are covered, and breaking expand or flatten makes TestExpand_CoreFields or TestFlatten_RoundTrip fail.
• The state claim in the body holds. terraform-plugin-framework v1.19.0 reads prior state with IgnoreUndefinedAttributes: true (internal/fwserver/server_upgraderesourcestate.go).
• The upstream claims hold at the pin. HTTPCache and its ResourceDefinition are gone (b24856561). Migration 56 creates kubernetes-nodes-<cluster>-<pool>, which maps back to KubernetesNodes <cluster>-<pool>, and it covers the implicit md0. The kafka pre-upgrade hook migrates ZooKeeper clusters to KRaft.
• make test, make lint and make docs are clean on 6078adb7e. Master is the merge base, so a trial merge gives the same tree.

Non-blocking

1. The body says each guard "still fails on anything else the API adds". This is true only for top-level keys. Nested fields added at the pin pass every guard: clickhouse backup endpointCA, mongodb backup useSystemBucket and insecureSkipTLSVerify, postgres bootstrap.backupID and postgresql.sharedPreloadLibraries, vpc subnet allowSubnets. The body becomes the merge commit, so I'd soften that sentence.
2. The pin also adds a new Valkey kind. Leaving it out is fine, but one line in Unreleased would stop anyone from assuming it is covered.

[scooby87]

Thanks for the review.

B1: fixed. users[].password is removed from cozystack_postgres and cozystack_mariadb (resources and data sources), with a breaking CHANGELOG entry that points at the <release>-credentials Secret. New guards compare each user entry against the pinned User type, so a field dropped from a user entry now fails a test. I also re-checked every json tag removed from the api types between v1.6.3 and the pin: apart from the blocks this PR already drops, password was the only one the provider still sent, and no enum lost a value.

B3: fixed. CLAUDE.md now says the pin is a temporary main pseudo-version that the first v1.7 tag replaces by hand. The Renovate rule only disabled digest updates; the pseudo-version sorts below the v1.6.x tags and patch updates automerge here, so an ordinary update could move the pin to v1.6.4 and drop the field. The rule now disables every update of the module until the tag pin returns.

Non-blocking: the body now says the guards cover top-level keys only, and the CHANGELOG notes that the Valkey kind and the new optional fields are not modelled yet.

B2: agreed that this is a release-order question, and it is the maintainers' call whether to cut v1.6.4 from master first or hold this PR for the v1.7 api tag. One correction on the second option: v1.7.0-alpha.3 does not contain 11499c30e. The tag points at 877d2ff43, published on 2026-09-29, before cozystack/cozystack#3775 and cozystack/cozystack#4648 were merged. GitHub's compare v1.7.0-alpha.3...11499c30e reports the pin 324 commits ahead with the tag commit as the merge base, and api/apps/v1alpha1/tenant/types.go at the tag has no tracingCentral. An api/apps/v1alpha1 tag cut from alpha.3 would therefore not carry the field; it would need a later alpha.

[Aleksei Sviridkin (lexfrei)]

scooby87 LGTM. The password removal and the pin notes are fixed, and B2 is closed: no provider release is being cut now, so merge order does not matter.

My review was wrong about the tag. v1.7.0-alpha.3 points at 877d2ff43 from 2026-09-29, and 11499c30e is not in it.

The pinned API removes nothing else the provider sends. I diffed api/apps/v1alpha1 between v1.6.3 and 11499c30e field by field. Apart from the HTTPCache, ZooKeeper and node-group types this PR already drops, the only removed json tags are the two User.password fields and kubernetes.Addons.fluxcd, which the provider never modelled. No enum lost a value. The new user guards fail both ways: adding password back to either expand, or emptying either user entry, turns the matching test red.

The Renovate rule has no update-type filter now, so it blocks every update of the module. That matters, because v1.6.4 also lacks tracingCentral.

make test, make lint and make docs (no diff) pass at 7ca1a59.