Fuzzball

• [deployment/fuzz-7590] Surfaced additional trusted issuers in the CRD to allow for endpoints to be trusted using tokens generated from a separate keycloak
• [fuzzball-cli/fuzz-7634] fuzzball object put and get now infer the object/file name from the source basename when the destination omits it. For put, a FB_URI ending in a trailing slash is filled in: 'put data.csv fb://group/' uploads to fb://group/data.csv and 'put -R mydir fb://group/' uploads the tree under fb://group/mydir/. For get, a LOCAL_PATH that names a directory (ends in a trailing slash, or is "." / "..") is filled in: 'get fb://group/data.csv ./' writes ./data.csv and 'get -R fb://group/mydir ./' writes the tree to ./mydir/. Destinations that already name the target are unchanged.
• [fuzzball-ui/fuzz-6805] Added a Download CLI page in the web interface, accessible from the Links menu in the sidebar. Logged-in users can download the Fuzzball CLI for macOS (Apple Silicon and Intel), Linux (x86_64 and ARM64), and Windows (x86_64), with platform-specific install instructions on the page. The downloaded binary's version always matches the deployed Fuzzball version because binaries are cross-built and embedded in the orchestrate container at build time.
• [fuzzball-ui/fuzz-770] include more fields in defaults

• [fuzzball-cli/fuzz-7698] Reworked fuzzball run --volume to express the full v4 volume model. A spec now has the form [KEY=][REF:]MOUNT[,size=SIZE][,KEY=VALUE...]:

  • --volume /scratch,size=100GiB,tier=fast -- an ephemeral volume of a given size, with annotations used for provisioner auto-selection.
  • --volume data:/mnt/data -- a persistent volume named "data".
  • --volume nfs-prod/data:/mnt/data -- a persistent volume "data" on the named provisioner "nfs-prod".

A bare mount path is an ephemeral volume, a bare name is a persistent volume, and the reserved ephemeral/persistent keywords still work. Trailing comma-separated parameters set the requested size (size=) and provisioner-selection annotations (any other key=value). Per FUZZ-4025, size and annotations are only valid for ephemeral volumes (no volume name); supplying them alongside a named/provisioner-qualified persistent volume is rejected with a clear error rather than producing a workflow that fails preflight. An optional KEY= prefix overrides the workflow-internal volume key. The legacy volume://<scope>/<class>[/<volume>] reference and 3-segment <scope>/<class>/<volume> form continue to be accepted for backward compatibility (size and annotations are not supported with those forms).

• [fuzzball-workflow/fuzz-7499] Federate now materializes service-scoped secret references when forwarding score requests to downstream clusters
• [fuzzball-orchestrate/fuzz-7632] Fixed fuzzball volume list so it returns every volume on a provisioner instead of silently stopping at the first 25. The server now paginates the full result set across all accessible provisioners and the CLI walks every page automatically; --page-size still controls only the per-request batch size. Results are returned in a stable order so paging is consistent.
• [fuzzball-storage/fuzz-7670] Fixed fuzzball volume list to exclude system-generated ephemeral volumes from the output. Previously, ephemeral volumes created during workflow execution (e.g., ephemeral/<workflow_id>/scratch) appeared alongside persistent volumes in the list.
• [fuzzball-orchestrate/fuzz-7676] Fixed removing or renaming a provisioner definition in central config failing with "currently used by N active instance(s)" when no instances were actually running.
• [fuzzball-storage/fuzz-7450] Removed the legacy reference field from volume info and list API responses. The v3-shape volume:// URI was incompatible with the v4 provisioner-based volume addressing model and misled users into pasting an unusable reference into --volume. Also corrected the --volume flag help text to show the correct 3-segment format (scope/provisioner/volume).
• [fuzzball-workflow/fuzz-7682] Fixed workflow catalogs with deprecated v1 mount syntax by parsing specifications server-side and upgrading to v4 format.
• [fuzzball-cli/fuzz-7643] fuzzball object list now walks every page automatically instead of stopping at the first response and printing a Next page token: ... hint. --page-size/-p still controls the per-request batch size; a new --max-pages/-m flag caps total pages fetched (0 = no cap). --page-token is retained as a hidden, deprecated no-op for backward compatibility with existing scripts.
• [fuzzball-cli/fuzz-7650] Fixed fuzzball node deprovision silently no-opping when given the node Id (the ip:port value shown in fuzzball node list). Previously only the node hostname actually terminated the instance; passing the node Id reported success while the node kept running. The CLI now resolves the node Id to its hostname before deprovisioning, so both forms work as the help advertises.
• [fuzzball-ui/fuzz-7702] Fixed bare ephemeral volumes being stripped when re-opening a workflow in the editor or rerunning from a previous run.
• [deployment/fuzz-7732] Issue certs before ingresses need them (kong fix)
• [deployment/fuzz-7751] Fixed Orchestrate and Federate clusters being deployed with unhelpful default names. Previously a cluster could come up as unset-cluster or with a timestamped stack name (e.g. fuzzball-20260618-170356). When no cluster name is provided, the operator now defaults it to the deployment's domain (e.g. example.com), and Federate clusters are prefixed with federate. (e.g. federate.example.com) so they are distinguishable. Explicitly configured cluster names are left unchanged (except unset-cluster, which is treated as unset). Existing clusters deployed with unset-cluster or a stack-derived name are renamed on the next reconcile.
• [fuzzball-storage/fuzz-7753] Fix storage provisioner conflict during replication on federate