Ænix.io
546 subscribers
236 photos
9 videos
315 links
Amplify your data center with cloud transformation

Cozystack developers: @cozystack

Contact: @kvaps @gecube @tym83
Download Telegram
🎥 Recordings from CozySummit Virtual 2026

What If Every Cozystack Change Became a Commit? | Simon Koudijs,
configbutler.ai

00:00 - Speaker intro and Config Butler background
00:47 - First impressions of Cozy Stack
01:19 - Resource history problem: who, when, and why
01:50 - Options for handling unmanaged platform changes
02:18 - Kubernetes audit files and audit webhooks
02:48 - Classic GitOps and its interface tradeoffs
03:41 - Live demo setup on a local Cozy Stack cluster
04:25 - Audience quiz submission demo
05:37 - Quiz submissions as Kubernetes custom resources
06:24 - Capturing platform changes as YAML in Git
06:41 - Classic GitOps vs reverse GitOps
07:13 - Reverse GitOps principles
08:05 - GitOps Reverser implementation overview
08:56 - Watch rules, Git targets, and Git providers
10:03 - Live Git commits from audience submissions
10:55 - Git author vs committer attribution
11:16 - Capturing the reason behind changes
11:29 - Coffee ordering demo intro
12:01 - Application artifacts and configuration state
12:32 - Coffee ordering and admin configuration demo
13:27 - Handling concurrent edits
14:22 - Completing the who, when, and why audit trail
14:50 - Why Cozy Stack fits reverse GitOps well
15:32 - Cozy Stack dashboard identity forwarding demo
16:21 - Capturing high-level resources and Flux changes
17:14 - Watch vs admission webhooks vs audit webhooks
17:43 - Benefits: auditability, GitOps on-ramp, and GUI usage
18:37 - Setup complexity and Kubernetes API limitations
19:10 - Secrets encryption and avoiding inline passwords
19:51 - Feedback request and future ideas
20:27 - Key takeaway: Kubernetes API as record of intent
20:54 - Links and feedback form
21:39 - Q&A begins
21:46 - Why not just snapshot or back up ETCD
22:22 - Server-side apply and field owners question
22:39 - YAML audit trail and resource history
22:52 - Git history length and conflict handling
24:00 - Conflict resolution strategy
24:31 - API interface for viewing Git changes
24:48 - Handling Git outages with Redis cache

Enjoy watching and share your thoughts: https://youtu.be/dkyjOq-I7Zs?si=qIwL5IiIU8ZxPArq
3
New on the Kubernetes blog: Andrei Kvapil /@kvaps and Timofei Larkin/@lllamnyp (Ænix) break down how the controller-runtime cache actually works — and why your controller isn't crashing the API server even at hundreds of reconciles per second.
If you write controllers in Go, this builds the mental model most people are missing: reads come from a local cache, writes go to the API server, and almost every production surprise (memory blowups, stale reads, silent O(n) scans) follows from that one fact.
https://kubernetes.io/blog/2026/07/29/controller-runtime-cache-explained/
🔥7
🚀Cozystack v1.6.0 is now available. The release was published on July 22, 2026, and includes all fixes previously shipped in the v1.5.1, v1.5.2, and v1.5.3 patch releases.

⚙️This release changes several important parts of the platform. Tenant Kubernetes workers now run Talos Linux instead of Ubuntu, tenants can enable OIDC authentication for Kubernetes and Grafana, and a new SecurityGroup API provides a safer interface for managing application network policies.

🧩Cozystack 1.6 also introduces hierarchical resource quotas, completes the etcd-operator v1alpha2 migration, expands Keycloak security and backup options, and makes application deletion consistently reclaim its storage.

👀The upgrade surface is larger than usual.

🧿Operators should review the upgrade section before applying the release.

Read the full release information in our social media👇
https://x.com/aenix_io/status/2082778204167868599 or
https://www.linkedin.com/pulse/cozystack-16-talos-workers-tenant-sso-security-groups-hierarchical-jkznf
6
😎Your infrastructure is already running.

💰But can your customers actually buy cloud services from it?

On August 19, Andrei Kvapil, creator of Cozystack, founder of AEnix, will walk through the full path from servers to a sellable public cloud:

• VMs, managed Kubernetes, databases and S3 storage
• Billing, usage metering and hosting panels
• WHMCS and custom integrations
• Migration from VMware, OpenStack or a custom stack
• A realistic two-week path to your first customers

Free live webinar.

Questions submitted during registration get priority in the live Q&A.

August 19 · 10:00 CET · Online

Register even if you cannot attend live. We will send you the recording.
Registration is now open!👇
https://aenix.io/webinars/launch-public-cloud/
👍1🔥1
New Cozystack Highlights: Persistent Public IPs.

Today IP addresses in Kubernetes are ephemeral. You create a LoadBalancer service, you get an IP, you delete the service, the IP is gone. Recreate it and you get a different one. For anyone running real workloads on public IPs, that churn is a problem, and Cozystack users have been asking to fix it for a while.

The prototype shown at the last community meeting borrows the model everyone already knows from storage: just like a PersistentVolumeClaim binds to a PersistentVolume through a StorageClass, an IPAddressClaim binds to an IPAddress through an IPAddressClass.

What that unlocks:
— Reserve an IP before attaching it to anything, then bind it to a service via annotation
— Delete the service, the IP stays reserved and comes back to the same claim
— Move one reserved IP between services without losing it
— Contention policies: keep an IP alive after its claim is deleted, or release it back to the pool
— A reserved IP can't be stolen by another service

The design is deliberately platform-agnostic. The core controller handles the claim-to-address logic; a separate driver talks to the backend, MetalLB today, but the same pattern fits AWS Elastic IPs or anything else, much like a CSI driver for storage.

Still a prototype, but the direction is set: IP addresses become a first-class, reservable resource in Cozystack.

🎥 Full demo from the community meeting: https://www.youtube.com/watch?v=cQJyA25Hf6U

#Cozystack #Kubernetes #Networking #CloudNative #OpenSource
🔥51👏1
Hi everyone, if you'd like to add anything to tomorrow's Cozystack community meeting agenda, feel free to reach out to @vsop78 or simply drop your ideas in the comments

When: Tomorrow at 18:00-19:00
(Central European Time, CET)
Where: Zoom
Link to join in:
https://zoom-lfx.platform.linuxfoundation.org/meeting/93845795591?password=a263fc60-ea72-41c8-84c8-a00d683ecee5

This meeting is free and open to everyone!
Come and join us!
🔥2
Catch you at the 70th Cozystack community meeting today!

When: Thursday at 18:00-19:00 (Central European Time, CET)
Where: Zoom
Link to join in:
https://zoom-lfx.platform.linuxfoundation.org/meeting/93845795591?password=a263fc60-ea72-41c8-84c8-a00d683ecee5

This meeting is free and open to everyone!
Come and join us!


Minutes:
https://docs.google.com/document/d/1YObSKsQ3Gzi1gSLPlUp-PbSYEeVkoyzY20M_hXKVhq4/edit?tab=t.0#heading=h.ygb3chatmgn2

📢 Agenda and Notes:
- Marketplace service in details

🎤 Open Floor:
-Test flakiness and platform stability: catching component conflicts earlier, isolating tests from external factors
- Discussion of versioning and release process
- Release frequency, semver vs calver and
- Backport strategy discussion
- Design proposal review: open proposals on GitHub https://github.com/cozystack/community/pulls
- Viewing backup process events in the web dashboard


🗓️Do not miss Cozystack community meetings:

https://webcal.prod.itx.linuxfoundation.org/lfx/lfsixxnFWxbvsyEuC2

https://zoom-lfx.platform.linuxfoundation.org/meetings/cozystack?view=month

💡Have a feature idea or design proposal for Cozystack?
Submit your Pull Request here: https://github.com/cozystack/community/pulls 🚀
🔥1
🚀The Cozystack team has open-sourced Blockstor, a control plane for block storage in Kubernetes: LVM and ZFS as backends, replication over DRBD, and a LINSTOR-compatible REST API. The project lives in the cozystack organization and is developed as part of Cozystack, a platform accepted into the CNCF Sandbox. The license is Apache 2.0.

🔥The main thing that makes it worth a look: it is not a fork, and it is not a wrapper. Blockstor is written from scratch in Go, but it speaks the same REST API as LINSTOR — so all the client tooling you already run keeps working without a single change: the linstor CLI, linstor-csi, piraeus-operator, and the golinstor library.

Read the full article in Cozystack blog 👇
https://cozystack.io/blog/2026/08/blockstor-linstor-compatible-storage-for-kubernetes/
Please open Telegram to view this post
VIEW IN TELEGRAM
1🔥12😱3🎉3🥴1
📣 This August, the Ænix team is bringing a series of hands-on open source private cloud workshops to four cities across Central Asia: Almaty, Bishkek, Tashkent and Astana.

The workshop focuses on moving beyond traditional virtualization and exploring cloud-native infrastructure for teams evaluating alternatives to VMware.

We’ll cover:

• how a modern cloud-native private cloud is built;
• how VMware components map to an open source stack;
• where Kubernetes, KubeVirt, LINSTOR, Cilium and GitOps fit in;
• how to migrate virtual machines and introduce self-service infrastructure;
• when migration makes sense and when keeping your existing VMware environment is the better choice.

Cozystack will be used as a hands-on example of an integrated platform for testing these concepts and migration scenarios in practice.

🗣️ The workshops will be led by Timur Tukaev, COO at Ænix, the team behind Cozystack.

📍 Almaty — August 13, 10:00–14:00
📍 Bishkek — August 17, 14:00–18:00
📍 Tashkent — August 20, 15:00–19:00
📍 Astana — August 24, 14:00–18:30

All workshops are in person and follow the same program.

🔗 Choose your city and register via the link: https://u.to/VpqnIg

🙌 Know someone in Almaty, Bishkek, Tashkent or Astana who might be interested?
If you have partners, colleagues or friends working with cloud infrastructure, virtualization or Kubernetes in these cities, please share this post with them.
👍4
We’ve open-sourced another tool we built: keycloak-kms-proxy.
Here’s the problem it solves.

Keycloak stores user PII, including email addresses, names and custom attributes, as plaintext in its database. Under GDPR, this is personal data and needs proper protection at rest.

Storage-level encryption or PostgreSQL-side encryption only gets you so far. The encryption key still lives close to the data, often inside the same PostgreSQL environment. Key rotation is also difficult to handle without downtime.

There are unofficial plugins that address this, such as Keycloak PII Data Encryption Provider. But they come with their own trade-offs: tight coupling to specific Keycloak versions, Java-level integration and a static encryption key passed through an environment variable.

We took a different approach. keycloak-kms-proxy is a transparent proxy that operates at the PostgreSQL wire-protocol level. It sits between Keycloak and PostgreSQL. Keycloak sees a regular Postgres database, while the proxy encrypts selected columns on write and decrypts them on read.

The design follows the same basic principles as Kubernetes KMSv2.
Every encrypted value is self-describing ($KKP$...), which means the proxy can safely work with a partially encrypted database while the backfill utility gradually processes existing records.

KEK rotation in Vault is fully transparent. The key version is stored alongside each wrapped DEK, so existing data remains decryptable without migrations or downtime.

In Cozystack, this is already available as an optional feature in the system Keycloak package. Enable encryption in the Helm chart and the proxy is deployed automatically. Keycloak is then reconfigured to connect through it, with no additional setup required.
🔥311
Last Thursday in Almaty (Kazakhstan), a room packed with engineers spent three hours migrating VMs off VMware. Not watching a demo. Actually doing it.

Timur Tukaev aka @tym83 led the workshop: convert OVA to QCOW2, push images to S3, and boot VMs on Cozystack. Then came the ultimate time-sink: untangling the networking assumptions VMware had quietly baked into those machines over the years. Throw in PostgreSQL and Kafka, wire them together, and keep tweaking the Java app until it finally came alive.

Later that day, Timur took the stage again to talk about the future of Kubernetes. Short version: the exciting work has shifted from the cluster itself to what's being built on top of it. The full talk is going up on the Cloud Native Kazakhstan YouTube channel, alongside sessions on hiding the control plane, Kubescape, cross-account Istio on AWS, and a case study on swapping Ceph for Longhorn.

Attendees get to keep their Cozystack tenant for 30 days. No overnight resets — this is a real setup to stress-test properly. Plus, it doubles as a stepping stone toward Cozystack administrator certification.

Next up: Bishkek (Aug 17), Tashkent (Aug 20), and Astana (Aug 24). Europe in October, the US in November, and a global online session in early September.

Links and details here: aenix.io/workshops/vmware-to-cozystack

One final takeaway: the migration is the easy part. The real bottleneck is that vCenter and Veeam live in people's fingers, not in the docs. It’s 15 years of muscle memory. Nobody budgets time for unlearning — and that’s exactly what kills a pilot.

P.S. Huge thanks to the organizers, the team at QOSI (Qazaq Open Source Initiative) and everyone who came out! Appreciate the invite, your trust, and the incredible vibes.

P.P.S. A massive shout-out to Ivan Okhotnikov aka @xor_dev — a rockstar engineer on the Ænix team and an all-around awesome human. Thanks for helping pre-bake the workshop code, pulling those all-nighters, and providing real-time tech support (Google Meets and all) for our attendees while the workshop was live.
🔥3👏3
Hi everyone, if you'd like to add anything to tomorrow's Cozystack community meeting agenda, feel free to reach out to @vsop78 or simply drop your ideas in the comments

When: Tomorrow at 18:00-19:00 (CEST) / 16:00-17:00 (UTC)
Where: Zoom
Link to join in:
https://zoom-lfx.platform.linuxfoundation.org/meeting/93845795591?password=a263fc60-ea72-41c8-84c8-a00d683ecee5
Agenda: https://docs.google.com/document/d/1YObSKsQ3Gzi1gSLPlUp-PbSYEeVkoyzY20M_hXKVhq4/edit?tab=t.0

This meeting is free and open to everyone!
Come and join us!
Ænix.io
Photo
We just wrapped up the same setup in Bishkek 🇰🇬 on August 17th. Technically, it was the exact same deep dive as in Almaty 🇰🇿, but with a twist: no sponsors, no external organizers.

It was a purely DIY effort — we ran the whole show ourselves.
And here is the absolute best part: every single attendee made it to the finish line and successfully completed the migration. 100% completion rate. That’s massive for a hands-on workshop!

Huge thanks to the Bishkek tech community for the incredible energy, focus, and drive. You came to build, not just to watch.

💡 Want us to bring this workshop to your city?
If your local community or engineering team wants to learn how to ditch VMware and experience Cozystack hands-on, just drop a comment below or shoot @vsop78 a DM. Let’s make it happen!

Next stops on the tour:  Astana (August 24th) and Tashkent (August 26th)
👍1