feat!: pin the cozystack API with shared-central tracing and add tenant tracing_central

CHANGELOG.md

@@ -2,10 +2,20 @@
 
 ## Unreleased
 
-To ship with the first Cozystack API pin that contains cozystack/cozystack#3936.
+Tracks the Cozystack API at main commit `11499c30e`, ahead of the first v1.7 tag: it is the first commit carrying the shared-central tracing field, and it already contains cozystack/cozystack#3936.
+
+The pinned API also adds a `Valkey` kind and optional fields on several existing kinds; the provider does not model them yet.
+
+### Features
+
+- `cozystack_tenant`: new `tracing_central` attribute (default `false`), also on the data source. It sends the tenant's traces to the shared VictoriaTraces store in `tenant-root` instead of a per-tenant backend, and needs `monitoring = true` on the tenant and `tenant-root` hosting the store.
 
 ### Breaking changes
 
+- `cozystack_httpcache` (resource and data source) is removed, following Cozystack, which dropped the HTTPCache application and its ResourceDefinition: a cluster on this API no longer serves the kind. Remove the resource from your configuration and run `terraform state rm` for each instance before upgrading the provider.
+- `cozystack_kubernetes`: `node_groups` and `node_health_check` are removed (resource and data source). Cozystack moved worker pools out of the Kubernetes application into KubernetesNodes, and its upgrade migrates every existing node group, the default `md0` included, into a KubernetesNodes object named `<cluster>-<pool>`. Drop both attributes from the configuration and bring each migrated pool under management with `terraform import cozystack_kubernetes_nodes.<name> <namespace>/<cluster>-<pool>`.
+- `cozystack_kafka`: `zookeeper` is removed (resource and data source). Cozystack runs Kafka in KRaft mode and migrates existing ZooKeeper clusters on upgrade, so the block has nothing left to configure. Drop it from the configuration.
+- `cozystack_postgres` and `cozystack_mariadb`: `users[].password` is removed (resources and data sources). Cozystack always generates user passwords now and ignores a password in the spec, so a configured one never took effect and state showed a password that was not the live one. Read the live password from the `postgres-<name>-credentials` or `mariadb-<name>-credentials` Secret. On a release upgraded from an older Cozystack, the password set before the removal stays in that Secret until it is rotated.
 - `rabbitmq`: the default `resources_preset` moves from `t1.nano` to `s1.nano`. The attribute is optional-with-default, so the old value sits in existing state: after upgrading the provider, a `cozystack_rabbitmq` that never set it explicitly plans `t1.nano` → `s1.nano`, which updates the cluster and rolls its pods. Set `resources_preset = "t1.nano"` explicitly to keep the previous sizing.
 
 ## v1.6.3

CLAUDE.md

@@ -20,7 +20,7 @@ The provider talks to the Cozystack aggregated Kubernetes API (`apps.cozystack.i
 
 ## Conventions
 
-- The provider version tracks the Cozystack API version it builds against; the `github.com/cozystack/cozystack/api/apps/v1alpha1` module is pinned to a released tag (currently `v1.6.3`), never a pseudo-version.
+- The provider version tracks the Cozystack API version it builds against; the `github.com/cozystack/cozystack/api/apps/v1alpha1` module is pinned to a released tag. The one exception is temporary: it is currently pinned to the pseudo-version of cozystack main commit `11499c30e`, the first one carrying the Tenant `tracingCentral` field, because no API tag contains it yet. Go orders that pseudo-version below `v1.6.3`, so moving to any v1.6.x tag would silently drop the field. Replace the pin by hand with the first `api/apps/v1alpha1` v1.7 tag, and in the same change restore the Renovate rule for this module in `renovate.json` to disabling `digest` updates only.
 - Typed models are guarded against upstream spec drift by `assertSpecCoverage(t, emitted, ConfigSpec{}, omit...)`, which reflects emitted spec keys against the api-module's `ConfigSpec` json tags. For Kinds whose Go types live in the heavy root cozystack module, a small vendored guard struct stands in.
 - Adding a Kind: add the `client.Resource` constructor, register it in `provider.go`, choose typed vs rawspec vs marker, add a unit test (with the spec-coverage guard for typed models), add `examples/resources/` + `examples/data-sources/` entries, then run `make docs`. A model with server-generated outputs implements `outputsReader` (`readOutputs` + `outputsPending`), which is what `wait_for_ready` polls on.
 

README.md

@@ -21,7 +21,6 @@ Every kind is served by the same aggregated API, so the provider is built to gro
 | Managed NATS | [`cozystack_nats`](docs/resources/nats.md) | [`cozystack_nats`](docs/data-sources/nats.md) |
 | Managed OpenSearch | [`cozystack_opensearch`](docs/resources/opensearch.md) | [`cozystack_opensearch`](docs/data-sources/opensearch.md) |
 | Managed PostgreSQL | [`cozystack_postgres`](docs/resources/postgres.md) | [`cozystack_postgres`](docs/data-sources/postgres.md) |
-| HTTP cache | [`cozystack_httpcache`](docs/resources/httpcache.md) | [`cozystack_httpcache`](docs/data-sources/httpcache.md) |
 | TCP load balancer | [`cozystack_tcpbalancer`](docs/resources/tcpbalancer.md) | [`cozystack_tcpbalancer`](docs/data-sources/tcpbalancer.md) |
 | Harbor registry | [`cozystack_harbor`](docs/resources/harbor.md) | [`cozystack_harbor`](docs/data-sources/harbor.md) |
 | Virtual private cloud | [`cozystack_vpc`](docs/resources/vpc.md) | [`cozystack_vpc`](docs/data-sources/vpc.md) |
@@ -105,7 +104,6 @@ To avoid persisting secrets in state, the provider offers modern Terraform secre
 resource "cozystack_kubernetes" "app" {
   name           = "app"
   namespace      = "tenant-root"
-  node_groups    = { md0 = { min_replicas = 1, max_replicas = 3 } }
   wait_for_ready = true
 }