Release cortex v0.3.2

.github/actions/setup-claude-code-action/action.yml

@@ -39,7 +39,7 @@ runs:
         echo "$HOME/.bun/bin" >> "$GITHUB_PATH"
 
     - name: Setup Python
-      uses: actions/setup-python@v6
+      uses: actions/setup-python@v7
       with:
         python-version: "3.13"
 

.github/workflows/claude-assistant.yaml

@@ -62,7 +62,7 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@v7
       - name: Set up Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v7
         with:
           go-version-file: 'go.mod'
       - name: Generate GitHub App token

.github/workflows/claude-weekly.yaml

@@ -17,7 +17,7 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@v7
       - name: Set up Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v7
         with:
           go-version-file: 'go.mod'
       - name: Generate GitHub App token

.github/workflows/codeql.yaml

@@ -29,7 +29,7 @@ jobs:
       - name: Check out code
         uses: actions/checkout@v7
       - name: Set up Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v7
         with:
           check-latest: true
           go-version-file: 'go.mod'

.github/workflows/helm-lint.yaml

@@ -23,7 +23,7 @@ jobs:
       - name: Set up Helm
         uses: azure/setup-helm@v5.0.1
 
-      - uses: actions/setup-python@v6.3.0
+      - uses: actions/setup-python@v7.0.0
         with:
           python-version: "3.13"
           check-latest: true

.github/workflows/lint.yaml

@@ -18,7 +18,7 @@ jobs:
       - name: Check out code
         uses: actions/checkout@v7
       - name: Set up Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v7
         with:
           go-version-file: 'go.mod'
       - name: Run make crds deepcopy lint-fix

.github/workflows/test.yaml

@@ -23,7 +23,7 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@v7
       - name: Set up Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v7
         with:
           go-version-file: 'go.mod'
       - name: Run tests and calculate coverage

.github/workflows/update-appversion.yml

@@ -30,7 +30,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           ref: ${{ github.ref }}
           persist-credentials: false

CHANGELOG.md

@@ -1,5 +1,58 @@
 # Changelog
 
+## 2026-07-22 — [#1068](https://github.com/cobaltcore-dev/cortex/pull/1068)
+
+### cortex v0.3.2 (sha-378ee2f5)
+
+Non-breaking changes:
+- Filter KVM hypervisors for non-KVM images — adds a new Nova scheduler filter that removes KVM hypervisors from scheduling candidates when the image declares a non-KVM hypervisor type ([#1067](https://github.com/cobaltcore-dev/cortex/pull/1067))
+- Improve FlavorGroupCapacity CRD observability with better metrics and status reporting ([#942](https://github.com/cobaltcore-dev/cortex/pull/942))
+- Protect pipeline maps with RWMutex to prevent concurrent map read/write data race ([#1066](https://github.com/cobaltcore-dev/cortex/pull/1066))
+- Fix broken relative links in quickstart and develop docs ([#1063](https://github.com/cobaltcore-dev/cortex/pull/1063))
+- Update `actions/setup-go` to v7 ([#1049](https://github.com/cobaltcore-dev/cortex/pull/1049))
+- Update `actions/setup-python` to v7 ([#1062](https://github.com/cobaltcore-dev/cortex/pull/1062))
+- Update `github.com/sapcc/go-bits` ([#1059](https://github.com/cobaltcore-dev/cortex/pull/1059), [#1071](https://github.com/cobaltcore-dev/cortex/pull/1071), [#1074](https://github.com/cobaltcore-dev/cortex/pull/1074))
+- Update external dependencies: `actions/checkout` v7.0.1, `go-logr/logr` v1.4.4, `prometheus/client_golang` v1.24.0 ([#1072](https://github.com/cobaltcore-dev/cortex/pull/1072))
+
+### cortex-shim v0.1.8 (sha-378ee2f5)
+
+Includes updated image sha-378ee2f5.
+
+### cortex-postgres v0.6.10 (sha-e06153f8)
+
+Includes updated image sha-e06153f8.
+
+### cortex-nova v0.0.82
+
+Includes updated charts cortex v0.3.2, cortex-postgres v0.6.10.
+
+- Add alert for missing hypervisor properties and KVM pipeline registration ([#1067](https://github.com/cobaltcore-dev/cortex/pull/1067))
+- Update `kube-prometheus-stack` to v87.19.0 ([#1061](https://github.com/cobaltcore-dev/cortex/pull/1061), [#1075](https://github.com/cobaltcore-dev/cortex/pull/1075))
+
+### cortex-cinder v0.0.82
+
+Includes updated charts cortex v0.3.2, cortex-postgres v0.6.10.
+
+### cortex-manila v0.0.82
+
+Includes updated charts cortex v0.3.2, cortex-postgres v0.6.10.
+
+### cortex-crds v0.0.82
+
+Includes updated chart cortex v0.3.2.
+
+### cortex-ironcore v0.0.82
+
+Includes updated chart cortex v0.3.2.
+
+### cortex-pods v0.0.82
+
+Includes updated chart cortex v0.3.2.
+
+### cortex-placement-shim v0.1.8
+
+Includes updated chart cortex-shim v0.1.8.
+
 ## 2026-07-16 — [#1051](https://github.com/cobaltcore-dev/cortex/pull/1051)
 
 ### cortex v0.3.1 (sha-fc47858e)

api/external/nova/messages.go

@@ -315,6 +315,48 @@ type NovaImageMeta struct {
 	Properties      NovaObject[map[string]any] `json:"properties"`
 }
 
+type NovaImageMetaHVType string
+
+const (
+	NovaImageMetaHVTypeVMware    NovaImageMetaHVType = "vmware"
+	NovaImageMetaHVTypeBaremetal NovaImageMetaHVType = "baremetal"
+	NovaImageMetaHVTypeKVM       NovaImageMetaHVType = "kvm"
+)
+
+// GetHypervisorType determines the hypervisor type based on the image properties.
+func (m NovaImageMeta) GetHypervisorType() (NovaImageMetaHVType, error) {
+	if m.Properties.Data == nil {
+		return "", errors.New("image properties are not set")
+	}
+	keys := []string{
+		// See https://github.com/sapcc/nova/blob/27eb1f0/nova/scheduler/filters/image_props_filter.py#L55
+		"img_hv_type", // Used by kvm images
+		// See https://github.com/sapcc/nova/blob/27eb1f0/doc/source/admin/configuration/hypervisor-vmware.rst#tag-vmware-images
+		"hypervisor_type", // Used by other images (e.g., VMware)
+	}
+	for _, key := range keys {
+		val, ok := m.Properties.Data[key]
+		if !ok {
+			continue
+		}
+		str, ok := val.(string)
+		if !ok {
+			return "", fmt.Errorf("hypervisor type in image properties is not a string: %v", val)
+		}
+		switch strings.ToLower(str) {
+		case "vmware":
+			return NovaImageMetaHVTypeVMware, nil
+		case "baremetal":
+			return NovaImageMetaHVTypeBaremetal, nil
+		case "kvm":
+			return NovaImageMetaHVTypeKVM, nil
+		default:
+			return "", fmt.Errorf("unsupported hypervisor type in image properties: %s", str)
+		}
+	}
+	return "", errors.New("hypervisor type not found in image properties")
+}
+
 // Nova flavor metadata for the specified VM.
 type NovaFlavor struct {
 	ID          int               `json:"id"`

api/external/nova/messages_test.go

@@ -491,3 +491,81 @@ func TestNovaSpecUnmarshal(t *testing.T) {
 		t.Errorf("Expected NumInstances to be 1, got %d", spec.Spec.Data.NumInstances)
 	}
 }
+
+func TestNovaImageMeta_GetHypervisorType(t *testing.T) {
+	tests := []struct {
+		name        string
+		properties  map[string]any
+		propsNil    bool
+		expected    NovaImageMetaHVType
+		expectError bool
+	}{
+		{
+			name:       "kvm via img_hv_type",
+			properties: map[string]any{"img_hv_type": "kvm"},
+			expected:   NovaImageMetaHVTypeKVM,
+		},
+		{
+			name:       "vmware via hypervisor_type",
+			properties: map[string]any{"hypervisor_type": "vmware"},
+			expected:   NovaImageMetaHVTypeVMware,
+		},
+		{
+			name:       "baremetal via hypervisor_type",
+			properties: map[string]any{"hypervisor_type": "baremetal"},
+			expected:   NovaImageMetaHVTypeBaremetal,
+		},
+		{
+			name:       "case insensitive",
+			properties: map[string]any{"img_hv_type": "KVM"},
+			expected:   NovaImageMetaHVTypeKVM,
+		},
+		{
+			name:       "img_hv_type takes precedence over hypervisor_type",
+			properties: map[string]any{"img_hv_type": "kvm", "hypervisor_type": "vmware"},
+			expected:   NovaImageMetaHVTypeKVM,
+		},
+		{
+			name:        "properties nil",
+			propsNil:    true,
+			expectError: true,
+		},
+		{
+			name:        "no hypervisor key present",
+			properties:  map[string]any{"other_key": "value"},
+			expectError: true,
+		},
+		{
+			name:        "unsupported hypervisor type",
+			properties:  map[string]any{"img_hv_type": "xen"},
+			expectError: true,
+		},
+		{
+			name:        "value not a string",
+			properties:  map[string]any{"img_hv_type": 42},
+			expectError: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			meta := NovaImageMeta{}
+			if !tt.propsNil {
+				meta.Properties = NovaObject[map[string]any]{Data: tt.properties}
+			}
+			got, err := meta.GetHypervisorType()
+			if tt.expectError {
+				if err == nil {
+					t.Fatalf("expected an error, got nil (result: %q)", got)
+				}
+				return
+			}
+			if err != nil {
+				t.Fatalf("expected no error, got %v", err)
+			}
+			if got != tt.expected {
+				t.Errorf("expected %q, got %q", tt.expected, got)
+			}
+		})
+	}
+}

docs/develop.md

@@ -56,7 +56,7 @@ The `testsum` target provides cleaner output by showing only full verbose output
 
 Helm charts bundle the application into a package, containing all the [Kubernetes](https://kubernetes.io/docs/tutorials/hello-minikube/) resources needed to run the application. The configuration for the application is specified in the [Helm `values.yaml`](cortex.secrets.example.yaml).
 
-Read [the helm chart structure documentation](helm/README.md) for more information about the structure of the Helm charts used in this repository.
+Read [the helm chart structure documentation](../helm/README.md) for more information about the structure of the Helm charts used in this repository.
 
 For local development, use the `cortex.secrets.example.yaml` file to override the default Helm values. You can write your OpenStack credentials here to include credentials, such as SSO certificates to access Prometheus metrics or OpenStack credentials to authenticate with Keystone.
 

docs/quickstart.md

@@ -2,7 +2,7 @@
 
 ### 1. Tilt Values Setup
 
-Copy the example secrets values file. This file is used for local development and overrides the Helm chart values provided in [values.yaml](helm/cortex/values.yaml) for your local testing setup.
+Copy the example secrets values file. This file is used for local development and overrides the Helm chart values provided in [values.yaml](../helm/library/cortex/values.yaml) for your local testing setup.
 ```bash
 cp cortex.secrets.example.yaml "${HOME}/cortex.secrets.yaml"
 ```

go.mod

@@ -7,9 +7,9 @@ require (
 	github.com/go-gorp/gorp v2.2.0+incompatible
 	github.com/gophercloud/gophercloud/v2 v2.13.0
 	github.com/ironcore-dev/ironcore v0.4.3
-	github.com/prometheus/client_golang v1.23.2
+	github.com/prometheus/client_golang v1.24.0
 	github.com/prometheus/client_model v0.6.2
-	github.com/sapcc/go-bits v0.0.0-20260709170107-f8ef1547bb62
+	github.com/sapcc/go-bits v0.0.0-20260721134224-acf388eecf26
 	go.xyrillian.de/gg v1.11.1
 	k8s.io/api v0.36.2
 	k8s.io/apimachinery v0.36.2
@@ -55,7 +55,7 @@ require (
 	github.com/felixge/httpsnoop v1.0.4 // indirect
 	github.com/fsnotify/fsnotify v1.9.0 // indirect
 	github.com/fxamacker/cbor/v2 v2.9.0 // indirect
-	github.com/go-logr/logr v1.4.3
+	github.com/go-logr/logr v1.4.4
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/go-logr/zapr v1.3.0 // indirect
 	github.com/go-openapi/jsonpointer v0.22.4 // indirect
@@ -85,8 +85,8 @@ require (
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
 	github.com/poy/onpar v0.3.5 // indirect
-	github.com/prometheus/common v0.69.0 // indirect
-	github.com/prometheus/procfs v0.19.2 // indirect
+	github.com/prometheus/common v0.70.0 // indirect
+	github.com/prometheus/procfs v0.21.1 // indirect
 	github.com/sapcc/go-api-declarations v1.24.0
 	github.com/sirupsen/logrus v1.9.3 // indirect
 	github.com/spf13/cobra v1.10.2 // indirect
@@ -109,12 +109,12 @@ require (
 	go.yaml.in/yaml/v3 v3.0.4 // indirect
 	go4.org/netipx v0.0.0-20231129151722-fdeea329fbba // indirect
 	golang.org/x/exp v0.0.0-20251219203646-944ab1f22d93 // indirect
-	golang.org/x/net v0.56.0 // indirect
+	golang.org/x/net v0.57.0 // indirect
 	golang.org/x/oauth2 v0.36.0 // indirect
 	golang.org/x/sync v0.22.0
 	golang.org/x/sys v0.47.0 // indirect
 	golang.org/x/term v0.45.0
-	golang.org/x/text v0.38.0 // indirect
+	golang.org/x/text v0.40.0 // indirect
 	golang.org/x/time v0.15.0 // indirect
 	gomodules.xyz/jsonpatch/v2 v2.5.0 // indirect
 	google.golang.org/genproto/googleapis/api v0.0.0-20260414002931-afd174a4e478 // indirect