We've just released the second release candidate for the next
Kubernetes Operator 2.12.0.
To recap, 2.12.0 brings support for shared storage: LVM storage pools
backed by storage shared between nodes, such as a SAN, can now be
registered using the new lvmPool.sharedSpace key, optionally relying on
an external lock manager like lvmlockd via lvmPool.externalLocking. The
Operator also handles TLS certificate rotation for Satellites and
Controller, no longer needs cluster-wide access to Secrets, drops the
deprecated csi-health-monitor sidecar, and raises the minimum supported
Kubernetes version to 1.30. See the rc.1 announcement for the details.
Since rc.1, we changed the fsGroupPolicy of the CSIDriver to "File".
Previously, Kubernetes only applied a Pod's fsGroup to ReadWriteOnce
volumes. It is now also applied to ReadWriteMany volumes in Filesystem
mode, which are served over NFS. Keep in mind that this changes the
ownership of all files on the NFS export when a Pod with fsGroup starts.
For large volumes, set fsGroupChangePolicy: OnRootMismatch in the Pod's
securityContext to skip the recursive ownership change if the root
directory already has the expected owner. [1]
LINSTOR 1.35.1 adds automatic database exports: by default, the
Controller exports its database once a day and keeps the last seven
exports. The Operator now mounts a writable emptyDir at /var/lib/linstor
in the Controller Pod so the export works with the read-only root
filesystem. Note that the exports live in the Pod and are gone once the
Pod is recreated. LINSTOR 1.35.1 also fixes resizing volumes in shared
storage pools with external locking, and a race between the block
device probe and udev.
LINSTOR CSI 1.13.1 restricts RWX block volumes without DRBD to the
storage and LUKS layers, as cache layers keep node-local data that other
nodes would never see. RWX block volumes on shared storage without DRBD
also skip the KubeVirt VM ownership check, so coordinating concurrent
access is left to the user.
The upgrade notes from rc.1 still apply: LINSTOR CSI 1.13 requires
LINSTOR 1.35 or newer, so if you run an external LINSTOR Controller,
upgrade it first. LINSTOR 1.35 also drops the unused access-control
tables from its database on upgrade, so a downgrade to an older LINSTOR
version is not possible afterwards.
To upgrade, either point your kustomization.yaml at the new manifest:
https://charts.linstor.io/static/v2.12.0-rc.2.yaml
Or, if using helm, upgrade the linstor-operator chart:
helm repo update
helm upgrade linstor-operator linstor/linstor-operator --wait
--version 2.12.0-rc.2
To get specific instructions to apply the update, check our users
guide[2].
Source code is, as always, available upstream[3].
Please help by testing this release!
Best regards,
Moritz
[1]: Upgrades - Piraeus Datastore
[2]: LINSTOR 1.0 en - LINBIT
[3]: GitHub - piraeusdatastore/piraeus-operator: The Piraeus Operator manages LINSTOR clusters in Kubernetes. · GitHub
---
### Added
- Precompiled DRBD kernel module images for Red Hat Enterprise Linux
CoreOS 10.
### Changed
- Set `fsGroupPolicy: File` on the CSIDriver, so `fsGroup` is also
applied to `ReadWriteMany` volumes in `Filesystem` mode.
- Updated images:
* LINSTOR 1.35.1
* LINSTOR CSI 1.13.1
### Fixed
- Mount an `emptyDir` volume at `/var/lib/linstor` in the LINSTOR
Controller, so the periodic database export works with the read-only
root filesystem.