We've just released a release candidate for the next Kubernetes Operator 2.12.0.
It contains a number of improvements that warrant a longer release
phase for testing. We also dropped support for old Kubernetes versions:
the new minimum supported version is 1.30.
The big new feature is support for shared storage. The Operator can now
register LVM storage pools backed by storage shared between nodes, such
as a SAN, using the new lvmPool.sharedSpace key. If the hosts already
run an external lock manager like lvmlockd, lvmPool.externalLocking
tells LINSTOR to rely on it instead of its own locking. [1] LINSTOR CSI
builds on this: RWX block volumes no longer need a DRBD layer when all
storage pools are backed by shared storage, and LINSTOR itself gained a
lot of improvements around shared storage pools, including support for
live migrations.
The Operator also learned to handle TLS certificate rotation. With
internalTLS or apiTLS enabled, Satellite and Controller containers now
detect rotated certificates, for example after cert-manager renewed
them, and restart to pick them up. The restart does not interrupt
replication, as DRBD connections stay up in the kernel. [2]
We have also tightened the permissions of our components: neither the
Operator nor the CSI controller has cluster-wide access to Secrets
anymore. If you use S3 backups, you now have to explicitly grant the CSI
controller access to the Secret holding the S3 credentials. [3] The
deprecated csi-health-monitor sidecar has been removed as well. Volume
health is now reported by LINSTOR CSI directly via the new CSI 1.13
RPCs.
We also have the usual round of improvements and bug fixes by updating
our components. LINSTOR 1.35.0 adds snapshots for thick LVM pools and
fixes a number of issues around shared storage pools. LINSTOR CSI 1.13.0
updates the NFS server to NFS-Ganesha 9.14, fixing I/O errors on RWX
volumes with clients running Linux 6.19 or newer. The HA Controller no
longer taints nodes for freshly created resources that briefly report no
quorum. The Satellite now actually merges the host's lvm.conf and
lvmlocal.conf into its LVM configuration and copies over LVM profiles.
Two things to keep in mind when upgrading: LINSTOR CSI 1.13.0 requires
LINSTOR 1.35 or newer, so if you run an external LINSTOR Controller,
upgrade it first. LINSTOR 1.35 also drops the unused access-control
tables from its database on upgrade, so a downgrade to an older LINSTOR
version is not possible afterwards.
To upgrade, either point your kustomization.yaml at the new manifest:
https://charts.linstor.io/static/v2.12.0-rc.1.yaml
Or, if using helm, upgrade the linstor-operator chart:
helm repo update
helm upgrade linstor-operator linstor/linstor-operator --wait
--version 2.12.0-rc.1
To get specific instructions to apply the update, check our users guide[4].
Source code is, as always, available upstream[5].
Please help by testing this release!
Best regards,
Moritz
[1]: LinstorSatelliteConfiguration - Piraeus Datastore
[2]: Configure TLS Between LINSTOR Controller and LINSTOR Satellite - Piraeus Datastore
[3]: Back Up Volumes to S3 - Piraeus Datastore
[4]: LINSTOR 1.0 en - LINBIT
[5]: GitHub - piraeusdatastore/piraeus-operator: The Piraeus Operator manages LINSTOR clusters in Kubernetes. · GitHub
---
### Added
- Support shared LVM storage pools: setting `lvmPool.sharedSpace`
registers the storage pool as backed by storage shared between nodes,
optionally using an external lock manager such as lvmlockd
(`lvmPool.externalLocking`).
- Support rotation of Satellite TLS certificates: with `internalTLS`
enabled, the Satellite container will restart to pick up a rotated
certificate.
- Support rotation of Controller TLS certificates: with `internalTLS` or
`apiTLS` enabled, restarting the Controller container to pick up a
rotated certificate.
### Changed
- The minimum supported Kubernetes version is now v1.30.
- Updated images:
* LINSTOR 1.35.0
* LINSTOR CSI 1.13.0
* HA Controller 1.3.4
### Removed
- Removed the cluster-wide permission to read Secrets from the CSI
controller: access to Secrets referenced in a `VolumeSnapshotClass`,
such as S3 credentials, now needs to be granted explicitly.
- Removed the cluster-wide permission to read and modify Secrets from
the Operator: it now manages Secrets only in its own namespace, using a
namespaced Role.
- Removed the deprecated `csi-health-monitor` sidecar
(csi-external-health-monitor-controller) from the CSI controller
deployment, along with its RBAC rules and default image.
### Fixed
- Actually merge the host's `lvm.conf` and `lvmlocal.conf` into the LVM
configuration used by the satellite, and copy over LVM profiles from the
host.