fix(networking): correct what disabledPackages does to ouroboros

content/de/_index.md

@@ -8,7 +8,7 @@ seo:
   title: "Cozystack — Open-Source Private Cloud auf Kubernetes"
   description: "Open-Source-Cloud-Plattform auf Kubernetes für Managed VMs, Datenbanken, S3-Storage und GPU-Workloads. CNCF-Sandbox-Projekt."
   keywords: ["private cloud", "managed kubernetes", "kubernetes plattform", "open source cloud"]
-source_digest: "sha256:24e38da4716b93c35dcb9eb607152d193ef3d5ad42c0e22a25063a89da9f8dde"
+source_digest: "sha256:e8f982c2431355bc79d3bb2133781cc539553c4c0a293d36e4c23dc54e7fcf80"
 translation_status: current
 l10n: transcreate
 taglines:
@@ -83,6 +83,17 @@ features:
 <!-- Screenshot Gallery -->
 {{< home/screenshot-gallery >}}
 
+<!-- Live Demo -->
+<div class="section-live-demo">
+{{< blocks/lead color="primary" >}}
+<h2 class="section-label">Sehen Sie die Konsole, bevor Sie irgendetwas installieren</h2>
+
+Das echte Dashboard von Cozystack, vollständig in Ihrem Browser — kein Cluster, keine Anmeldung, keine Einrichtung. Stöbern Sie im Marketplace, öffnen Sie Managed Services, klicken Sie sich durch die Konsole. Es ist die echte UI, nur mit Demo-Daten.
+
+<a class="btn btn-lg btn-primary mt-4" href="/demo/">Live-Demo öffnen &rarr;</a>
+{{< /blocks/lead >}}
+</div>
+
 <!-- Benefits & Features -->
 
 {{< home/benefits >}}

content/en/docs/next/networking/hairpin-proxy-protocol.md

@@ -119,7 +119,7 @@ Disabling has different shapes on the two layers, by design. The host path has a
 The platform refuses to render the bare flag flip when a `cozystack.ouroboros` Package CR is already on the cluster — `helm template` / `helm upgrade` fails fast with an error that points at `kubectl delete package.cozystack.io cozystack.ouroboros` (which triggers helm uninstall and the chart's pre-delete cleanup hook) and the acknowledgement field. The vendored chart carries a pre-delete hook (`charts/ouroboros/templates/coredns-cleanup-hook.yaml`) that quiesces the controller and `sed`-strips the `# === BEGIN ouroboros … END ouroboros ===` block from `kube-system/coredns` automatically when helm actually uninstalls the chart — operators do **not** need to run the manual `sed` recipe in the normal disable path. The full host disable sequence is:
 
 1. Flip the upstream LB off PROXY-protocol injection (external traffic precondition).
-2. Remove the Package CR with `kubectl delete package.cozystack.io cozystack.ouroboros` (or add it to `bundles.disabledPackages`). This triggers helm uninstall, which fires the chart's pre-delete hook and patches `kube-system/coredns` automatically.
+2. Remove the Package CR with `kubectl delete package.cozystack.io cozystack.ouroboros`. This triggers helm uninstall, which fires the chart's pre-delete hook and patches `kube-system/coredns` automatically. Adding the name to `bundles.disabledPackages` is **not** a second way to get there. `disabledPackages` will not remove components that are already installed: the list only stops the platform chart from emitting the Package document, and `helm.sh/resource-policy: keep` leaves the live Package on the cluster along with the HelmRelease it owns. ouroboros keeps running, the pre-delete hook never fires, and no platform values setting reaches it.
 3. Set `publishing.proxyProtocol: false` in the platform values. The render guard now passes (the `lookup` for `cozystack.ouroboros` returns nil after step 2), so `publishing.proxyProtocolAcknowledgeUnclean` stays at its default `false`.
 
 If the operator has reason to flip `publishing.proxyProtocol: false` BEFORE deleting the Package CR (strict GitOps where `kubectl delete` is not in-band, parallel rollbacks, etc.), set `publishing.proxyProtocolAcknowledgeUnclean: true` together with the flag flip in the same commit, then drive the Package deletion separately. Flip `proxyProtocolAcknowledgeUnclean` back to `false` once the cluster has been clean for one reconcile cycle. This is the escape valve, not the recommended path — the staged sequence above keeps the ack flag at its default and avoids the round-trip.

content/en/docs/v1.4/networking/hairpin-proxy-protocol.md

@@ -119,7 +119,7 @@ Disabling has different shapes on the two layers, by design. The host path has a
 The platform refuses to render the bare flag flip when a `cozystack.ouroboros` Package CR is already on the cluster — `helm template` / `helm upgrade` fails fast with an error that points at `kubectl delete package.cozystack.io cozystack.ouroboros` (which triggers helm uninstall and the chart's pre-delete cleanup hook) and the acknowledgement field. The vendored chart carries a pre-delete hook (`charts/ouroboros/templates/coredns-cleanup-hook.yaml`) that quiesces the controller and `sed`-strips the `# === BEGIN ouroboros … END ouroboros ===` block from `kube-system/coredns` automatically when helm actually uninstalls the chart — operators do **not** need to run the manual `sed` recipe in the normal disable path. The full host disable sequence is:
 
 1. Flip the upstream LB off PROXY-protocol injection (external traffic precondition).
-2. Remove the Package CR with `kubectl delete package.cozystack.io cozystack.ouroboros` (or add it to `bundles.disabledPackages`). This triggers helm uninstall, which fires the chart's pre-delete hook and patches `kube-system/coredns` automatically.
+2. Remove the Package CR with `kubectl delete package.cozystack.io cozystack.ouroboros`. This triggers helm uninstall, which fires the chart's pre-delete hook and patches `kube-system/coredns` automatically. Adding the name to `bundles.disabledPackages` is **not** a second way to get there. `disabledPackages` will not remove components that are already installed: the list only stops the platform chart from emitting the Package document, and `helm.sh/resource-policy: keep` leaves the live Package on the cluster along with the HelmRelease it owns. ouroboros keeps running, the pre-delete hook never fires, and no platform values setting reaches it.
 3. Set `publishing.proxyProtocol: false` in the platform values. The render guard now passes (the `lookup` for `cozystack.ouroboros` returns nil after step 2), so `publishing.proxyProtocolAcknowledgeUnclean` stays at its default `false`.
 
 If the operator has reason to flip `publishing.proxyProtocol: false` BEFORE deleting the Package CR (strict GitOps where `kubectl delete` is not in-band, parallel rollbacks, etc.), set `publishing.proxyProtocolAcknowledgeUnclean: true` together with the flag flip in the same commit, then drive the Package deletion separately. Flip `proxyProtocolAcknowledgeUnclean` back to `false` once the cluster has been clean for one reconcile cycle. This is the escape valve, not the recommended path — the staged sequence above keeps the ack flag at its default and avoids the round-trip.

content/en/docs/v1.5/networking/hairpin-proxy-protocol.md

@@ -119,7 +119,7 @@ Disabling has different shapes on the two layers, by design. The host path has a
 The platform refuses to render the bare flag flip when a `cozystack.ouroboros` Package CR is already on the cluster — `helm template` / `helm upgrade` fails fast with an error that points at `kubectl delete package.cozystack.io cozystack.ouroboros` (which triggers helm uninstall and the chart's pre-delete cleanup hook) and the acknowledgement field. The vendored chart carries a pre-delete hook (`charts/ouroboros/templates/coredns-cleanup-hook.yaml`) that quiesces the controller and `sed`-strips the `# === BEGIN ouroboros … END ouroboros ===` block from `kube-system/coredns` automatically when helm actually uninstalls the chart — operators do **not** need to run the manual `sed` recipe in the normal disable path. The full host disable sequence is:
 
 1. Flip the upstream LB off PROXY-protocol injection (external traffic precondition).
-2. Remove the Package CR with `kubectl delete package.cozystack.io cozystack.ouroboros` (or add it to `bundles.disabledPackages`). This triggers helm uninstall, which fires the chart's pre-delete hook and patches `kube-system/coredns` automatically.
+2. Remove the Package CR with `kubectl delete package.cozystack.io cozystack.ouroboros`. This triggers helm uninstall, which fires the chart's pre-delete hook and patches `kube-system/coredns` automatically. Adding the name to `bundles.disabledPackages` is **not** a second way to get there. `disabledPackages` will not remove components that are already installed: the list only stops the platform chart from emitting the Package document, and `helm.sh/resource-policy: keep` leaves the live Package on the cluster along with the HelmRelease it owns. ouroboros keeps running, the pre-delete hook never fires, and no platform values setting reaches it.
 3. Set `publishing.proxyProtocol: false` in the platform values. The render guard now passes (the `lookup` for `cozystack.ouroboros` returns nil after step 2), so `publishing.proxyProtocolAcknowledgeUnclean` stays at its default `false`.
 
 If the operator has reason to flip `publishing.proxyProtocol: false` BEFORE deleting the Package CR (strict GitOps where `kubectl delete` is not in-band, parallel rollbacks, etc.), set `publishing.proxyProtocolAcknowledgeUnclean: true` together with the flag flip in the same commit, then drive the Package deletion separately. Flip `proxyProtocolAcknowledgeUnclean` back to `false` once the cluster has been clean for one reconcile cycle. This is the escape valve, not the recommended path — the staged sequence above keeps the ack flag at its default and avoids the round-trip.

content/en/docs/v1.6/networking/hairpin-proxy-protocol.md

@@ -119,7 +119,7 @@ Disabling has different shapes on the two layers, by design. The host path has a
 The platform refuses to render the bare flag flip when a `cozystack.ouroboros` Package CR is already on the cluster — `helm template` / `helm upgrade` fails fast with an error that points at `kubectl delete package.cozystack.io cozystack.ouroboros` (which triggers helm uninstall and the chart's pre-delete cleanup hook) and the acknowledgement field. The vendored chart carries a pre-delete hook (`charts/ouroboros/templates/coredns-cleanup-hook.yaml`) that quiesces the controller and `sed`-strips the `# === BEGIN ouroboros … END ouroboros ===` block from `kube-system/coredns` automatically when helm actually uninstalls the chart — operators do **not** need to run the manual `sed` recipe in the normal disable path. The full host disable sequence is:
 
 1. Flip the upstream LB off PROXY-protocol injection (external traffic precondition).
-2. Remove the Package CR with `kubectl delete package.cozystack.io cozystack.ouroboros` (or add it to `bundles.disabledPackages`). This triggers helm uninstall, which fires the chart's pre-delete hook and patches `kube-system/coredns` automatically.
+2. Remove the Package CR with `kubectl delete package.cozystack.io cozystack.ouroboros`. This triggers helm uninstall, which fires the chart's pre-delete hook and patches `kube-system/coredns` automatically. Adding the name to `bundles.disabledPackages` is **not** a second way to get there. `disabledPackages` will not remove components that are already installed: the list only stops the platform chart from emitting the Package document, and `helm.sh/resource-policy: keep` leaves the live Package on the cluster along with the HelmRelease it owns. ouroboros keeps running, the pre-delete hook never fires, and no platform values setting reaches it.
 3. Set `publishing.proxyProtocol: false` in the platform values. The render guard now passes (the `lookup` for `cozystack.ouroboros` returns nil after step 2), so `publishing.proxyProtocolAcknowledgeUnclean` stays at its default `false`.
 
 If the operator has reason to flip `publishing.proxyProtocol: false` BEFORE deleting the Package CR (strict GitOps where `kubectl delete` is not in-band, parallel rollbacks, etc.), set `publishing.proxyProtocolAcknowledgeUnclean: true` together with the flag flip in the same commit, then drive the Package deletion separately. Flip `proxyProtocolAcknowledgeUnclean` back to `false` once the cluster has been clean for one reconcile cycle. This is the escape valve, not the recommended path — the staged sequence above keeps the ack flag at its default and avoids the round-trip.

content/hi/_index.md

@@ -8,7 +8,7 @@ seo:
   title: "Cozystack — Kubernetes पर ओपन-सोर्स प्राइवेट क्लाउड"
   description: "Kubernetes पर ओपन-सोर्स क्लाउड प्लेटफ़ॉर्म: मैनेज्ड VMs, डेटाबेस, S3 स्टोरेज और GPU वर्कलोड। CNCF Sandbox प्रोजेक्ट।"
   keywords: ["private cloud", "managed kubernetes", "kubernetes platform", "cloud platform"]
-source_digest: "sha256:24e38da4716b93c35dcb9eb607152d193ef3d5ad42c0e22a25063a89da9f8dde"
+source_digest: "sha256:e8f982c2431355bc79d3bb2133781cc539553c4c0a293d36e4c23dc54e7fcf80"
 translation_status: current
 l10n: transcreate
 taglines:
@@ -83,6 +83,17 @@ features:
 <!-- Screenshot Gallery -->
 {{< home/screenshot-gallery >}}
 
+<!-- Live Demo -->
+<div class="section-live-demo">
+{{< blocks/lead color="primary" >}}
+<h2 class="section-label">कुछ भी इंस्टॉल करने से पहले कंसोल देखें</h2>
+
+Cozystack का असली डैशबोर्ड, पूरी तरह आपके ब्राउज़र में चलता हुआ — न क्लस्टर, न साइनअप, न सेटअप। मार्केटप्लेस देखें, मैनेज्ड सेवाएँ खोलें, कंसोल में क्लिक करके घूमें। यह असली UI ही है, बस डेमो डेटा के साथ।
+
+<a class="btn btn-lg btn-primary mt-4" href="/demo/">लाइव डेमो खोलें &rarr;</a>
+{{< /blocks/lead >}}
+</div>
+
 <!-- Benefits & Features -->
 
 {{< home/benefits >}}

content/ru/_index.md

@@ -8,7 +8,7 @@ seo:
   title: "Cozystack — частное облако с открытым кодом на Kubernetes"
   description: "Open-source облачная платформа на Kubernetes: управляемые ВМ, базы данных, S3-хранилище и GPU. Проект CNCF Sandbox."
   keywords: ["частное облако", "managed kubernetes", "kubernetes платформа", "облачная платформа"]
-source_digest: "sha256:24e38da4716b93c35dcb9eb607152d193ef3d5ad42c0e22a25063a89da9f8dde"
+source_digest: "sha256:e8f982c2431355bc79d3bb2133781cc539553c4c0a293d36e4c23dc54e7fcf80"
 translation_status: current
 l10n: transcreate
 taglines:
@@ -83,6 +83,17 @@ features:
 <!-- Screenshot Gallery -->
 {{< home/screenshot-gallery >}}
 
+<!-- Live Demo -->
+<div class="section-live-demo">
+{{< blocks/lead color="primary" >}}
+<h2 class="section-label">Посмотрите на консоль до того, как что-то устанавливать</h2>
+
+Настоящая панель управления Cozystack, целиком работающая в браузере — без кластера, без регистрации, без настройки. Загляните в маркетплейс, откройте управляемые сервисы, покликайте по консоли. Это тот самый интерфейс, только с демонстрационными данными.
+
+<a class="btn btn-lg btn-primary mt-4" href="/demo/">Открыть живое демо &rarr;</a>
+{{< /blocks/lead >}}
+</div>
+
 <!-- Benefits & Features -->
 
 {{< home/benefits >}}

content/zh-cn/_index.md

@@ -8,7 +8,7 @@ seo:
   title: "Cozystack — 基于 Kubernetes 的开源私有云"
   description: "基于 Kubernetes 的开源云平台，提供托管虚拟机、数据库、S3 存储和 GPU 工作负载。CNCF Sandbox 项目。"
   keywords: ["私有云", "Kubernetes", "开源云平台", "托管 Kubernetes"]
-source_digest: "sha256:24e38da4716b93c35dcb9eb607152d193ef3d5ad42c0e22a25063a89da9f8dde"
+source_digest: "sha256:e8f982c2431355bc79d3bb2133781cc539553c4c0a293d36e4c23dc54e7fcf80"
 translation_status: current
 l10n: transcreate
 taglines:
@@ -83,6 +83,17 @@ features:
 <!-- Screenshot Gallery -->
 {{< home/screenshot-gallery >}}
 
+<!-- Live Demo -->
+<div class="section-live-demo">
+{{< blocks/lead color="primary" >}}
+<h2 class="section-label">先看看控制台，再决定是否安装</h2>
+
+真实的 Cozystack 仪表盘，完全在你的浏览器中运行——无需集群、无需注册、无需配置。浏览应用市场，打开托管服务，随意点击体验控制台。这就是真正的 UI，只是换成了演示数据。
+
+<a class="btn btn-lg btn-primary mt-4" href="/demo/">打开在线演示 &rarr;</a>
+{{< /blocks/lead >}}
+</div>
+
 <!-- Benefits & Features -->
 
 {{< home/benefits >}}