Conversation
…elds Two small gaps surfaced repeatedly in the Russian community chat: 1. helm upgrade --install of the cozy-installer chart fails on any cluster where the cozy-system namespace already exists (for example from an aborted previous attempt) with 'namespaces "cozy-system" already exists'. Add --take-ownership to the documented command and explain why it is needed. 2. The networking section of the platform Package shows podCIDR, podGateway, serviceCIDR, and joinCIDR in the example, but the surrounding prose only says 'internal networking configurations' and does not describe joinCIDR at all. Users ended up asking what 100.64.0.0/16 was for and why it defaults to that range. Describe each networking.* field individually, call out the RFC 6598 shared address space rationale for joinCIDR, and link to the upstream Kube-OVN join subnet reference. Assisted-By: Claude <noreply@anthropic.com> Signed-off-by: Aleksei Sviridkin <f@lex.la>
- Explain that --take-ownership (Helm 3.17+) adopts the cozy-system namespace when it exists without the meta.helm.sh/release-name annotation, not just when the namespace name is taken. Cover both error phrasings Helm can emit (namespaces already exists vs invalid ownership metadata), depending on the Helm version. - Drop the vague 'usually the first usable address' hedge on podGateway and give a concrete example that matches the YAML above. - Switch the Kube-OVN join-subnet reference to the stable docs URL. Assisted-By: Claude <noreply@anthropic.com> Signed-off-by: Aleksei Sviridkin <f@lex.la>
…lank Stop pinning the note to specific Helm error strings (which depend on Helm version and the exact race) and just say plainly that the flag lets Helm adopt a namespace missing the meta.helm.sh/release-name annotation. Also remove a stray double blank line before the next H2. Assisted-By: Claude <noreply@anthropic.com> Signed-off-by: Aleksei Sviridkin <f@lex.la>
…notes - Rewrite the --take-ownership paragraph to cover both sources of ownership conflict (missing Helm annotations and annotations from a different release) and to describe the failure mode accurately: Helm detects the conflict during rendering and aborts before installing anything. - Replace the 'first host address' wording for podGateway with the unambiguous '.1 address of the podCIDR network' plus the existing 10.244.0.1 example. - Explain why the serviceCIDR must match the Kubernetes bootstrap value: the CIDR is baked into kube-apiserver at bootstrap and cannot be changed without rebuilding the cluster, so a mismatch silently breaks DNS and service routing. Assisted-By: Claude <noreply@anthropic.com> Signed-off-by: Aleksei Sviridkin <f@lex.la>
…note Helm detects the ownership conflict when it applies the rendered manifests, not during client-side rendering. Rendering only transforms templates into manifests and has no knowledge of cluster state. Assisted-By: Claude <noreply@anthropic.com> Signed-off-by: Aleksei Sviridkin <f@lex.la>
✅ Deploy Preview for cozystack ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
|
Warning Rate limit exceeded
Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 8 minutes and 7 seconds. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughUpdated the Cozystack operator Helm installation command to include the Changes
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~5 minutes Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates the Cozystack installation guide to include the --take-ownership Helm flag and provides detailed documentation for networking configuration parameters. Feedback includes a technical correction regarding the RFC 6598 address space and suggestions for consistent terminology in the networking section.
| the value is baked into the kube-apiserver at bootstrap time and cannot be changed without | ||
| rebuilding the cluster, so a mismatch here silently breaks DNS and service routing. | ||
| - `networking.joinCIDR` — CIDR range for the Kube-OVN *join* subnet, the internal network that carries | ||
| traffic between cluster nodes and pods. The default `100.64.0.0/16` is a shared address space |
There was a problem hiding this comment.
Technically, RFC 6598 defines the shared address space as 100.64.0.0/10. The default 100.64.0.0/16 used here is a subset of that space. It is more precise to state that it is "part of" the shared address space.
| traffic between cluster nodes and pods. The default `100.64.0.0/16` is a shared address space | |
| traffic between cluster nodes and pods. The default 100.64.0.0/16 is part of the shared address space |
There was a problem hiding this comment.
Applied — reworded the joinCIDR bullet to say that the default 100.64.0.0/16 is part of the RFC 6598 shared address space 100.64.0.0/10.
| - `networking.joinCIDR` — CIDR range for the Kube-OVN *join* subnet, the internal network that carries | ||
| traffic between cluster nodes and pods. The default `100.64.0.0/16` is a shared address space | ||
| ([RFC 6598](https://datatracker.ietf.org/doc/html/rfc6598)) that is reserved for this kind of | ||
| internal-only use. Change it only if it collides with a network your nodes already reach; see the |
There was a problem hiding this comment.
For consistency with the description of podCIDR (lines 98-99), consider using the terms "overlaps" and "route" instead of "collides" and "reach". This maintains a uniform technical vocabulary throughout the networking section.
| internal-only use. Change it only if it collides with a network your nodes already reach; see the | |
| internal-only use. Change it only if it overlaps with a network your nodes already route; see the |
There was a problem hiding this comment.
Applied — switched to overlaps / route so the joinCIDR bullet matches the podCIDR wording earlier in the same networking section.
…ten joinCIDR note
Codex review flagged two real problems with using --take-ownership in
the default install command:
1. --take-ownership was only added in Helm 3.17. Distros and CI images
shipping older Helm will fail on an unknown flag before the reader
reaches the caveat paragraph.
2. Unconditionally letting Helm adopt cozy-system is unsafe when that
namespace is actually managed by Terraform, Argo CD, or a different
Helm release. The Cozystack release would silently take ownership
and later upgrades or an uninstall could mutate or delete the
namespace against the wishes of the other system.
Fix: keep the baseline command as --create-namespace only, and move
the --take-ownership guidance into an info callout that fires only
when the install actually aborts with an ownership error. The callout
states the Helm 3.17+ requirement up front and warns against using the
flag when the namespace is owned by another system.
Also address two inline review comments on the joinCIDR bullet:
- The RFC 6598 shared address space is /10, not /16. Say the default
100.64.0.0/16 is 'part of' that /10.
- Match the podCIDR wording ('overlaps' / 'route' instead of
'collides' / 'reach') for consistency inside the networking section.
Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
2 participants
What
Two small fixes to
content/en/docs/v1/getting-started/install-cozystack.mdcovering issues that keep showing up for newcomers in the community chat:--take-ownershipto the documentedhelm upgrade --installcommand for the Cozystack operator and explain when it is needed.networking.*field (podCIDR,podGateway,serviceCIDR,joinCIDR) instead of just saying "internal networking configurations". The example YAML already containsjoinCIDR: "100.64.0.0/16"but the prose explains nothing about it, which confuses people during the tutorial.Why
--take-ownership: a user ran the documented command against a cluster wherecozy-systemalready existed (aborted earlier install attempt, manually-created namespace, etc.) and hit an ownership conflict. They worked it out on the second try but the fix belongs in the doc. The flag was added in Helm 3.17 specifically for this scenario and is the standard way to adopt a pre-existing namespace that lacksmeta.helm.sh/release-name. The PR describes both sources of the conflict (no Helm annotations at all, or annotations pointing at a different release) and clarifies that Helm detects the conflict when applying the rendered manifests, not during template rendering.networking.*descriptions: another user asked in the community chat whatnetworking.joinCIDRwas for, because the current doc only lists the field in the example and labels the whole block "internal networking configurations". The PR adds a bullet for each field:podCIDRwith the "must not overlap with your node network" caveatpodGatewaywith a concrete rule (use the.1address of thepodCIDRnetwork, e.g.,10.244.0.1for10.244.0.0/16)serviceCIDRwith an explicit warning that the value is baked into the kube-apiserver at bootstrap and cannot be changed without rebuilding the cluster — mismatches silently break DNS and service routingjoinCIDRwith a link to the upstream Kube-OVN join subnet reference and a pointer to RFC 6598 explaining why100.64.0.0/16is the defaultVerification
hugobuilds cleanly; the new content renders as expected.--take-ownershipflag confirmed against Helm v3.17.0 release notes (https://github.com/helm/helm/releases/tag/v3.17.0).https://kubeovn.github.io/docs/stable/en/guide/subnet/#join-subnet).100.64.0.0/10shared address space (100.64.0.0/16is a subset).podGateway = .1 of podCIDRrule matches the Kube-OVN default gateway allocation and the existing YAML example.Summary by CodeRabbit