# LINSTOR Operator 2.12.0-rc.1 **URL:** https://forums.linbit.com/t/linstor-operator-2-12-0-rc-1/1264 **Category:** Release Announcements **Tags:** kubernetes, drbd **Created:** [September 3, 2026, 1:16pm UTC](https://forums.linbit.com/t/linstor-operator-2-12-0-rc-1/1264 "2026-09-03T13:16:38Z") **Posts on this page:** 1 **Page:** 1
### Author: ![Moritz\_Tanner](https://avatars.discourse-cdn.com/v4/letter/m/e36b37/32.png) [@Moritz\_Tanner](https://forums.linbit.com/u/Moritz_Tanner) #### Post date: [September 3, 2026, 1:16pm UTC](https://forums.linbit.com/t/linstor-operator-2-12-0-rc-1/1264/1 "2026-09-03T13:16:38Z")
We've just released a release candidate for the next Kubernetes Operator 2.12.0. It contains a number of improvements that warrant a longer release phase for testing. We also dropped support for old Kubernetes versions: the new minimum supported version is 1.30. The big new feature is support for shared storage. The Operator can now register LVM storage pools backed by storage shared between nodes, such as a SAN, using the new lvmPool.sharedSpace key. If the hosts already run an external lock manager like lvmlockd, lvmPool.externalLocking tells LINSTOR to rely on it instead of its own locking. [1] LINSTOR CSI builds on this: RWX block volumes no longer need a DRBD layer when all storage pools are backed by shared storage, and LINSTOR itself gained a lot of improvements around shared storage pools, including support for live migrations. The Operator also learned to handle TLS certificate rotation. With internalTLS or apiTLS enabled, Satellite and Controller containers now detect rotated certificates, for example after cert-manager renewed them, and restart to pick them up. The restart does not interrupt replication, as DRBD connections stay up in the kernel. [2] We have also tightened the permissions of our components: neither the Operator nor the CSI controller has cluster-wide access to Secrets anymore. If you use S3 backups, you now have to explicitly grant the CSI controller access to the Secret holding the S3 credentials. [3] The deprecated csi-health-monitor sidecar has been removed as well. Volume health is now reported by LINSTOR CSI directly via the new CSI 1.13 RPCs. We also have the usual round of improvements and bug fixes by updating our components. LINSTOR 1.35.0 adds snapshots for thick LVM pools and fixes a number of issues around shared storage pools. LINSTOR CSI 1.13.0 updates the NFS server to NFS-Ganesha 9.14, fixing I/O errors on RWX volumes with clients running Linux 6.19 or newer. The HA Controller no longer taints nodes for freshly created resources that briefly report no quorum. The Satellite now actually merges the host's lvm.conf and lvmlocal.conf into its LVM configuration and copies over LVM profiles. Two things to keep in mind when upgrading: LINSTOR CSI 1.13.0 requires LINSTOR 1.35 or newer, so if you run an external LINSTOR Controller, upgrade it first. LINSTOR 1.35 also drops the unused access-control tables from its database on upgrade, so a downgrade to an older LINSTOR version is not possible afterwards. To upgrade, either point your kustomization.yaml at the new manifest:   [https://charts.linstor.io/static/v2.12.0-rc.1.yaml](https://charts.linstor.io/static/v2.12.0-rc.1.yaml) Or, if using helm, upgrade the linstor-operator chart:   helm repo update   helm upgrade linstor-operator linstor/linstor-operator --wait --version 2.12.0-rc.1 To get specific instructions to apply the update, check our users guide[4]. Source code is, as always, available upstream[5]. Please help by testing this release! Best regards, Moritz [1]: [LinstorSatelliteConfiguration - Piraeus Datastore](https://piraeus.io/docs/latest/reference/linstorsatelliteconfiguration/#specstoragepools) [2]: [Configure TLS Between LINSTOR Controller and LINSTOR Satellite - Piraeus Datastore](https://piraeus.io/docs/latest/how-to/internal-tls/#certificate-rotation) [3]: [Back Up Volumes to S3 - Piraeus Datastore](https://piraeus.io/docs/latest/how-to/s3-backup/) [4]: [LINSTOR 1.0 en - LINBIT](https://linbit.com/drbd-user-guide/linstor-guide-1_0-en/#s-kubernetes-upgrade) [5]: [GitHub - piraeusdatastore/piraeus-operator: The Piraeus Operator manages LINSTOR clusters in Kubernetes. ยท GitHub](https://github.com/piraeusdatastore/piraeus-operator) --- ### Added - Support shared LVM storage pools: setting `lvmPool.sharedSpace` registers the storage pool as backed by storage shared between nodes, optionally using an external lock manager such as lvmlockd (`lvmPool.externalLocking`). - Support rotation of Satellite TLS certificates: with `internalTLS` enabled, the Satellite container will restart to pick up a rotated certificate. - Support rotation of Controller TLS certificates: with `internalTLS` or `apiTLS` enabled, restarting the Controller container to pick up a rotated certificate. ### Changed - The minimum supported Kubernetes version is now v1.30. - Updated images:     \* LINSTOR 1.35.0     \* LINSTOR CSI 1.13.0     \* HA Controller 1.3.4 ### Removed - Removed the cluster-wide permission to read Secrets from the CSI controller: access to Secrets referenced in a `VolumeSnapshotClass`, such as S3 credentials, now needs to be granted explicitly. - Removed the cluster-wide permission to read and modify Secrets from the Operator: it now manages Secrets only in its own namespace, using a namespaced Role. - Removed the deprecated `csi-health-monitor` sidecar (csi-external-health-monitor-controller) from the CSI controller deployment, along with its RBAC rules and default image. ### Fixed - Actually merge the host's `lvm.conf` and `lvmlocal.conf` into the LVM configuration used by the satellite, and copy over LVM profiles from the host.