# LINSTOR Operator 2.12.0 **URL:** \ **Category:** Release Announcements\ **Tags:** kubernetes, drbd\ **Created:** [September 17, 2026, 11:35am UTC](https://forums.linbit.com/t/linstor-operator-2-12-0/1276 "2026-09-17T11:35:47Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![Moritz\_Tanner](https://avatars.discourse-cdn.com/v4/letter/m/e36b37/32.png) [@Moritz\_Tanner](https://forums.linbit.com/u/Moritz_Tanner)\ **Post date:** [September 17, 2026, 11:35am UTC](https://forums.linbit.com/t/linstor-operator-2-12-0/1276/1 "2026-09-17T11:35:47Z")
We've just released the new feature release 2.12.0 of our Kubernetes Operator. Along with it, we dropped support for old Kubernetes versions: the new minimum supported version is 1.30. The big new feature is support for shared storage. The Operator can now register LVM storage pools backed by storage shared between nodes, such as a SAN. [1] LINSTOR CSI builds on this: RWX block volumes no longer need a DRBD layer when all storage pools are backed by shared storage, and LINSTOR itself gained a lot of improvements around shared storage pools, including support for live migrations. The Operator also learned to handle TLS certificate rotation. With internalTLS or apiTLS enabled, Satellite and Controller containers now detect rotated certificates, for example after cert-manager renewed them, and restart to pick them up. The restart does not interrupt replication, as DRBD connections stay up in the kernel. [2] We have also tightened the permissions of our components: neither the Operator nor the CSI controller has cluster-wide access to Secrets anymore. If you use S3 backups, you now have to explicitly grant the CSI controller access to the Secret holding the S3 credentials. [3] The CSIDriver now sets fsGroupPolicy: File. Previously, Kubernetes only applied a Pod's fsGroup to ReadWriteOnce volumes. It is now also applied to ReadWriteMany volumes in Filesystem mode, which are served over NFS. Keep in mind that this changes the ownership of all files on the NFS export when a Pod with fsGroup starts. For large volumes, set fsGroupChangePolicy: OnRootMismatch in the Pod's securityContext to skip the recursive ownership change if the root directory already has the expected owner. [4] We also have the usual round of improvements and bug fixes by updating our components. LINSTOR 1.35 adds snapshots for thick LVM pools and automatic database exports: by default, the Controller exports its database once a day and keeps the last seven exports. Note that the exports live in the Pod and are gone once the Pod is recreated. DRBD is updated to 9.3.4, which carries all fixes from 9.2.20. These include a number of cases where nodes could silently diverge after a reconnect or after losing a peer, so we recommend upgrading. [5] Two things to keep in mind when upgrading: LINSTOR CSI 1.13 requires LINSTOR 1.35 or newer, so if you run an external LINSTOR Controller, upgrade it first. To upgrade, either point your kustomization.yaml at the new manifest:   [https://charts.linstor.io/static/v2.12.0.yaml](https://charts.linstor.io/static/v2.12.0.yaml) Or, if using helm, upgrade the linstor-operator chart:   helm repo update   helm upgrade linstor-operator linstor/linstor-operator --wait --version 2.12.0 To get specific instructions to apply the update, check our users guide[6]. Source code is, as always, available upstream[7]. Best regards, Moritz [1]: [LinstorSatelliteConfiguration - Piraeus Datastore](https://piraeus.io/docs/stable/reference/linstorsatelliteconfiguration/#specstoragepools) [2]: [Configure TLS Between LINSTOR Controller and LINSTOR Satellite - Piraeus Datastore](https://piraeus.io/docs/stable/how-to/internal-tls/#certificate-rotation) [3]: [Back Up Volumes to S3 - Piraeus Datastore](https://piraeus.io/docs/stable/how-to/s3-backup/) [4]: [Upgrades - Piraeus Datastore](https://piraeus.io/docs/stable/upgrade/) [5]: [drbd/ChangeLog at master · LINBIT/drbd · GitHub](https://github.com/LINBIT/drbd/blob/master/ChangeLog) [6]: [LINSTOR 1.0 en - LINBIT](https://linbit.com/drbd-user-guide/linstor-guide-1_0-en/#s-kubernetes-upgrade) [7]: [GitHub - piraeusdatastore/piraeus-operator: The Piraeus Operator manages LINSTOR clusters in Kubernetes. · GitHub](https://github.com/piraeusdatastore/piraeus-operator) --- ### Added - Support shared LVM storage pools: setting `lvmPool.sharedSpace` registers the storage pool as backed by storage   shared between nodes, optionally using an external lock manager such as lvmlockd (`lvmPool.externalLocking`). - Support rotation of Satellite TLS certificates: with `internalTLS` enabled, the Satellite container will restart   to pick up a rotated certificate. - Support rotation of Controller TLS certificates: with `internalTLS` or `apiTLS` enabled, restarting the Controller   container to pick up a rotated certificate. - Precompiled DRBD kernel module images for Red Hat Enterprise Linux CoreOS 10. ### Changed - The minimum supported Kubernetes version is now v1.30. - Set `fsGroupPolicy: File` on the CSIDriver, so `fsGroup` is also applied to `ReadWriteMany` volumes in `Filesystem`   mode. - Updated images:     \* LINSTOR 1.35.2     \* LINSTOR CSI 1.13.1     \* DRBD 9.3.4     \* Latest CSI sidecars ### Removed - Removed the cluster-wide permission to read Secrets from the CSI controller: access to Secrets referenced in a   `VolumeSnapshotClass`, such as S3 credentials, now needs to be granted explicitly. - Removed the cluster-wide permission to read and modify Secrets from the Operator: it now manages Secrets only in   its own namespace, using a namespaced Role. - Removed the deprecated `csi-health-monitor` sidecar (csi-external-health-monitor-controller) from the CSI   controller deployment, along with its RBAC rules and default image. ### Fixed - Actually merge the host's `lvm.conf` and `lvmlocal.conf` into the LVM configuration used by the satellite, and   copy over LVM profiles from the host. - Mount an `emptyDir` volume at `/var/lib/linstor` in the LINSTOR Controller, so the periodic database export works   with the read-only root filesystem.