LINBIT/linstor-server v1.35.0-rc.1

on GitHub

[1.35.0-rc.1] - 2026-08-13

Added

• New linstor-controller-ha-setup script that makes the controller highly available via the drbd-reactor promoter,
  optionally with a virtual IP
• Snapshot support for thick LVM (LVM) storage pools: create, delete, restore into a new resource and rollback. Each
  snapshot reserves its origin's size as CoW area in the volume group, so it can never become invalid. Restore and
  rollback copy the full data with dd. Deleting a resource that still has snapshots renames the backing LV
  (_deleted_*); it is removed together with its last snapshot. Volumes with thick LVM snapshots cannot be resized (LVM
  limitation) and backup shipping remains unsupported
• Added a "truncate" operation for resource-definitions that atomically deletes all of a resource-definition's resources
  without touching the resource-definition or its snapshots (DELETE /v1/resource-definitions/{resource}/resources); an
  optional flag additionally deletes the resource-definition when it has neither resources nor snapshots left
  afterwards.
• Added an option to snapshot deletion that atomically deletes the resource-definition as well when, after deleting the
  snapshot, the resource-definition has neither resources nor snapshots left.
• make-available: new option auto_manage_dual_primary (REST 1.29.0) preparing a resource for a live migration
  to the given node: for DRBD resources allow-two-primaries (and protocol C if needed) is set between the migration
  source (the node the resource is in use on) and the target node; for resources in a shared storage pool the resource
  is activated on both nodes at once. If the resource is not in use on any node it is simply made available, so
  clients that cannot distinguish a live-migration attach from a plain attach can always set the option
• New API unmake-available reverting a make-available on the migration source after a live migration: removes
  the resource from the node if that is possible without losing data (diskless resources and redundant
  shared-storage-pool copies; tiebreaker and diskful resources are kept) and reverts the DRBD net options set by
  make-available. Calling it for a resource that is not deployed on the node is a successful no-op

Changed

• Snapshots of resources in shared storage pools are now registered on every node holding a copy of the resource,
  matching the shared data: the snapshot exists once on the shared pool, so every copy effectively holds it. Only
  the node with the active copy performs the snapshot storage operations (create, delete, restore); new or
  (re)activated copies automatically receive the snapshot objects. The active copy can therefore be moved freely
  (make-available, activate) while snapshots exist; if no copy is active at all, one is activated before taking a
  snapshot or rolling back
• Resizing a volume backed by a shared storage pool is now refused while its resource is active on more than one
  node (the dual-active window of a live migration), since the shared data cannot be safely resized while multiple
  nodes are accessing it; conversely, make-available with auto_manage_dual_primary refuses to open the
  dual-active window while a volume of the resource is still being resized
• Removed the access-control security subsystem (object protection, ACLs, security identities/roles/types and the
  protobuf sign-in API); it had always been running at NO_SECURITY level. The SEC_* database tables are dropped on
  upgrade, which makes a downgrade to older versions impossible. LDAP authentication for the REST API, satellite
  connection authentication, auth tokens and HTTPS client certificates are unaffected. Error reports no longer contain
  an access-context section and log lines are no longer prefixed with the security identity
• The controller now refuses to start with a clear error message when the SQL database was already migrated by a newer
  LINSTOR version, instead of failing while partially loading the unknown schema
• Added StltImplErrPeer so that node.getPeer is always non-null
• Upgraded the bundled H2 database from 1.4.197 to 2.4.240. Existing H2 databases are migrated to the new H2 file format
  automatically, either by the package upgrade or on the next start of the linstor-controller service; the migration
  can also be run manually via the new linstor-database migrate-h2 command.
  The original database file is kept as <database>.mv.db.h2v1.bak.
  Old-format error-report.mv.db files are moved aside and recreated empty
• The controller now refuses to start with a clear error message when the SQL database was already migrated
  by a newer LINSTOR version, instead of failing while partially loading the unknown schema

Fixed

• Fixed a DRBD resource deletion that was interrupted after the "prepare deletion" step (e.g. by a satellite
  disconnect or a controller restart) being stuck forever: the resource stayed in the intermediate DRBD_DELETE
  state, leaving an orphaned backing volume on the node and its DRBD peers endlessly trying to connect. The
  deletion is now automatically resumed once all nodes of the resource-definition are connected again
• Fixed snapshot rollback of a resource in a shared storage pool failing when another node holds an inactive copy:
  non-participating inactive copies are no longer recreated after the rollback (they can simply be made available
  again); if no copy is active at all, one is activated before the rollback
• Fixed satellites corrupting the metadata of a shared LVM volume group when starting simultaneously: probing an
  empty thick LVM storage pool for its block-device properties no longer creates a temporary LV (an unserialized
  VG metadata write); the properties are read from the pool's physical volume instead
• Fixed snapshot creation of an IO-suspended volume (e.g. LUKS on a shared storage pool) failing with a vgscan
  timeout: the shared-VG rescan no longer opens devices whose IO is suspended
• Fixed make-available for a resource in a shared storage pool failing with "No active resource found" when no
  resource of that shared storage pool was active anywhere (e.g. after cleanly stopping the consumer): the resource is
  now created on the requested node reusing the shared data, ending with a usable (active) resource
• Fixed creating an additional resource that reuses the existing data of a shared storage pool (e.g. via
  make-available) failing the free-space check on a (nearly) full pool: the shared volume already exists and the
  pool's free space already accounts for it, so attaching another resource to it consumes no additional space
• Fixed deleting a thick LVM snapshot re-activating the snapshot (and implicitly its origin LV) before the removal,
  leaving the origin LV of an INACTIVE resource active after the deletion - dangerous for shared storage pools
• Fixed deleting a snapshot in a shared storage pool hanging forever: a device-manager run that only processes snapshots
  (no resources) never requested the shared storage pool locks, so the run aborted with an internal error and the
  deletion was never executed
• Fixed LDAP sign-in using the configured search_filter as the LDAP search base; the configured search_base was
  never used, so restricting sign-in via a search filter did not work as documented
• Erase LUKS headers with 2 shred passes instead of 4 and only time the shred out when it stops making I/O
  progress, avoiding timeouts on slow storage (e.g. thick-LVM origins with active snapshots); also fixed
  misleading error messages on erase failures
• Fixed deleting a controller property namespace always failing the property whitelist check (the namespace was
  prepended twice to the property keys), rejecting and rolling back the whole modification
• Fixed deleting a resource connection reporting an internal error instead of success (the already deleted connection
  object was accessed when notifying the satellites)
• Fixed modifying a net interface of a node without an active satellite connection failing with an unhandled
  NullPointerException
• Fixed the query-size-info response cache never answering requests whose resource group name was not given in the
  canonical upper-case form, causing needless recomputation
• Fixed several connection API calls reporting an unhandled NullPointerException instead of a proper not-found error:
  creating a resource connection for an unknown resource, modifying a node connection of an unknown node, and
  creating/modifying a volume connection for an unknown volume number or a nonexistent connection
• Another attempt to fix issues with double reconnect
• Fixed possible ConcurrentModificationException during multiple concurrent reconnect attempts
• Fixed incorrect parsing of "" for DISC_GRAN in LsBlkEntry. "" will be parsed as 0
• Fixed AutoHelper now properly concat an updateSatellite at the end of the eagerly subscribed (aka Flux.merge'd)
  additionalFluxList.
• Fixed shared LVM storage pools failing make-available with "Logical Volume ... already exists" when another
  node had just created the LV; the cached lvs/vgs view is now invalidated after the shared-VG vgscan