feat(provider): add the cozystack_kubernetes_nodes resource

[Aleksei Sviridkin (lexfrei)]

Pull Request

Summary

Cozystack 1.6 introduced the KubernetesNodes kind, which splits worker node pools out of the Kubernetes CR so pools can be managed independently of the parent cluster. This adds the cozystack_kubernetes_nodes resource and matching data source, the only upstream app kind the provider did not register.

Defaults follow two rules. Stable semantic defaults (storage class, replica bounds, instance type, health checks, version) are materialised, mirroring the kubernetes kind. Drift-prone fields (talos, images, kubelet, roles, gpus) stay presence-preserving: the aggregated apiserver resolves their defaults on every read, and a Computed attribute would write the server-resolved Talos values back as explicit spec keys, pinning the pool to the Talos release current on creation day. Import is the deliberate exception so existing overrides are captured instead of silently deleted on the next update.

The CR must be named <cluster>-<pool>; a name colliding with a parent-managed node group fails on ownership conflict. Documented on the resource page.

Changes

• Add the KubernetesNodes client resource descriptor and register resource plus data source
• Typed model with spec-coverage guards for the nested talos, kubelet, images and GPU surfaces
• Add a config-validation hook to the generic resource machinery (no-op for every other kind)

Testing

• Unit tests pass locally (make test): 16 new KubernetesNodes tests pass; the branch inherits 7 spec-coverage failures from the integration base (v1.6.1 pin bump), fixed by the sibling PRs. Zero new failures, verified against the merge base.
• Linters pass locally (make lint)
• Generated docs are up to date (make docs produces no diff)
• Acceptance tests pass against a live cluster (make testacc), if applicable: needs a live parent cluster, planned as a follow-up before release

Documentation

• Examples added or updated under examples/
• Registry docs regenerated (make docs)
• CHANGELOG updated (if user-facing): a consolidated v1.6 section lands with the integration PR

Checklist

• Commit messages follow semantic format (type(scope): description)
• No secrets or credentials in code or state
• Breaking changes documented (none in this PR)

Additional Notes

Targets the feat/cozystack-1.6 integration branch, not master.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: a8e9c48e-ffe9-4568-8e9b-b265b610dfc1

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[IvanHunters]

Verdict

NOT LGTM

The resource itself is well-designed and its core claim holds up: there is no provider-side default that would pin a pool to the Talos release of its creation day, the presence-preserving round-trip is sound, and the new KubernetesNodes tests all pass. The change is not approved only because of one concrete, author-actionable blocker plus two minor items below. Fix the sign-off and this is essentially an approve.

Blocking

• [MAJOR] DCO check is red: a commit is not signed off. Commit 13100ebd8ead ("feat(provider): model the KubernetesNodes worker pool spec") lacks a Signed-off-by trailer; the other three commits have it. The PR cannot merge while DCO fails. Please git rebase --signoff feat/cozystack-1.6 (or amend that one commit) and force-push.

CI analysis (the red test check is inherited, not introduced here)

The test job fails only on *ExpandKeysMatchConfigSpec coverage guards for kinds this PR does not modify: tenant.gateway, cozystack_kubernetes oidc/talos/nodeHealthCheck/maxUnhealthy/nodeStartupTimeout, and nats/qdrant tls. This PR adds the cozystack_kubernetes_nodes resource and touches none of those models. The same tenant/kubernetes failures appear on sibling branch #22, which also does not touch them, confirming they live in the stacked base feat/cozystack-1.6 and are resolved by other PRs in the stack (#22 for tls, #25 for the kubernetes/tenant surface). The resource's own guards (TestKubernetesNodesExpandNestedKeysMatchTheirSpecs, naming/validation, three-state) all pass. So CI-red is not a reason for the NOT LGTM; the DCO sign-off is.

What was verified

• No creation-day Talos pin. expand emits talos/images/kubelet (at minimum {}) and omits roles/gpus when null; unset fields stay server-managed rather than being frozen to a default, so a pool is not silently pinned. keepConfigured* maps server-echoed empties back to null, so an unset block does not produce perpetual drift.
• Whole-spec replacement on update is real. client.Update does current.Object["spec"] = app.Spec (application.go), so any field present on the object but absent from config is dropped on the next apply. This is the correct, visible behaviour (capture-on-import surfaces the removal as a plan diff rather than losing it silently), but see the docs note below.
• version enum and naming validation match the nodes chart values.yaml; go vet and the new tests pass.

Minor findings

• [MINOR] kubernetes_nodes_schema.go:132: the pool version enum is OneOf("v1.35".."v1.31") and omits v1.30, which the parent cozystack_kubernetes version (kubernetes_schema.go:69) still accepts. Both the docs and the shipped example wire version = cozystack_kubernetes.cluster.version, so an operator running a parent cluster on v1.30 who copies the example gets a plan-time validation error on the pool. The enum matches the nodes chart, so this is a cross-resource inconsistency rather than a nodes-side bug, but worth reconciling or documenting.
• [MINOR] Import docs (docs/resources/kubernetes_nodes.md, Import section): because expand replaces the whole spec, any override captured on import (for example an air-gapped talos.installer_repository) that is not copied into the .tf config is dropped on the first apply. The capture-on-import design is the right choice (it makes the loss a visible plan diff instead of silent), but the docs should tell operators to reconcile talos/images/kubelet/roles/gpus into config before applying.

[Aleksei Sviridkin (lexfrei)]

Fixed: rebased with sign-off, every commit now carries a Signed-off-by matching the author. Also took the import note: the resource description now tells importers to copy captured overrides into configuration before the first apply (docs regenerated). On the v1.30 mismatch: #25 drops v1.30 from the parent validator, so the two resources agree once the stack lands.