We've just released the new feature release 2.12.0 of our Kubernetes
Operator. Along with it, we dropped support for old Kubernetes versions:
the new minimum supported version is 1.30.
The big new feature is support for shared storage. The Operator can now
register LVM storage pools backed by storage shared between nodes, such
as a SAN. [1] LINSTOR CSI builds on this: RWX block volumes no longer
need a DRBD layer when all storage pools are backed by shared storage,
and LINSTOR itself gained a lot of improvements around shared storage
pools, including support for live migrations.
The Operator also learned to handle TLS certificate rotation. With
internalTLS or apiTLS enabled, Satellite and Controller containers now
detect rotated certificates, for example after cert-manager renewed
them, and restart to pick them up. The restart does not interrupt
replication, as DRBD connections stay up in the kernel. [2]
We have also tightened the permissions of our components: neither the
Operator nor the CSI controller has cluster-wide access to Secrets
anymore. If you use S3 backups, you now have to explicitly grant the CSI
controller access to the Secret holding the S3 credentials. [3]
The CSIDriver now sets fsGroupPolicy: File. Previously, Kubernetes only
applied a Pod's fsGroup to ReadWriteOnce volumes. It is now also applied
to ReadWriteMany volumes in Filesystem mode, which are served over NFS.
Keep in mind that this changes the ownership of all files on the NFS
export when a Pod with fsGroup starts. For large volumes, set
fsGroupChangePolicy: OnRootMismatch in the Pod's securityContext to skip
the recursive ownership change if the root directory already has the
expected owner. [4]
We also have the usual round of improvements and bug fixes by updating
our components. LINSTOR 1.35 adds snapshots for thick LVM pools and
automatic database exports: by default, the Controller exports its
database once a day and keeps the last seven exports. Note that the
exports live in the Pod and are gone once the Pod is recreated.
DRBD is updated to 9.3.4, which carries all fixes from 9.2.20. These
include a number of cases where nodes could silently diverge after a
reconnect or after losing a peer, so we recommend upgrading. [5]
Two things to keep in mind when upgrading: LINSTOR CSI 1.13 requires
LINSTOR 1.35 or newer, so if you run an external LINSTOR Controller,
upgrade it first.
To upgrade, either point your kustomization.yaml at the new manifest:
https://charts.linstor.io/static/v2.12.0.yaml
Or, if using helm, upgrade the linstor-operator chart:
helm repo update
helm upgrade linstor-operator linstor/linstor-operator --wait --version 2.12.0
To get specific instructions to apply the update, check our users guide[6].
Source code is, as always, available upstream[7].
Best regards,
Moritz
[1]: LinstorSatelliteConfiguration - Piraeus Datastore
[2]: Configure TLS Between LINSTOR Controller and LINSTOR Satellite - Piraeus Datastore
[3]: Back Up Volumes to S3 - Piraeus Datastore
[4]: Upgrades - Piraeus Datastore
[5]: drbd/ChangeLog at master · LINBIT/drbd · GitHub
[6]: LINSTOR 1.0 en - LINBIT
[7]: GitHub - piraeusdatastore/piraeus-operator: The Piraeus Operator manages LINSTOR clusters in Kubernetes. · GitHub
---
### Added
- Support shared LVM storage pools: setting `lvmPool.sharedSpace`
registers the storage pool as backed by storage
shared between nodes, optionally using an external lock manager such
as lvmlockd (`lvmPool.externalLocking`).
- Support rotation of Satellite TLS certificates: with `internalTLS`
enabled, the Satellite container will restart
to pick up a rotated certificate.
- Support rotation of Controller TLS certificates: with `internalTLS`
or `apiTLS` enabled, restarting the Controller
container to pick up a rotated certificate.
- Precompiled DRBD kernel module images for Red Hat Enterprise Linux CoreOS 10.
### Changed
- The minimum supported Kubernetes version is now v1.30.
- Set `fsGroupPolicy: File` on the CSIDriver, so `fsGroup` is also
applied to `ReadWriteMany` volumes in `Filesystem`
mode.
- Updated images:
* LINSTOR 1.35.2
* LINSTOR CSI 1.13.1
* DRBD 9.3.4
* Latest CSI sidecars
### Removed
- Removed the cluster-wide permission to read Secrets from the CSI
controller: access to Secrets referenced in a
`VolumeSnapshotClass`, such as S3 credentials, now needs to be
granted explicitly.
- Removed the cluster-wide permission to read and modify Secrets from
the Operator: it now manages Secrets only in
its own namespace, using a namespaced Role.
- Removed the deprecated `csi-health-monitor` sidecar
(csi-external-health-monitor-controller) from the CSI
controller deployment, along with its RBAC rules and default image.
### Fixed
- Actually merge the host's `lvm.conf` and `lvmlocal.conf` into the
LVM configuration used by the satellite, and
copy over LVM profiles from the host.
- Mount an `emptyDir` volume at `/var/lib/linstor` in the LINSTOR
Controller, so the periodic database export works
with the read-only root filesystem.