We are excited to announce another release of Ceph CSI, v3.18.0. This is another significant step towards using enhanced Container Storage Interface (CSI) features with Ceph Cluster in the backend. With this release, we are introducing many brand-new features and enhancements to the Ceph CSI driver. Here are the changelog/release highlights.

Changelog and Highlights:

NOTE

• The RADOS lock that serializes fscrypt setup for encrypted CephFS volumes is now taken in the CephFS RADOS namespace instead of the default namespace of the metadata pool. This applies to every deployment with encrypted volumes. cephFS.radosNamespace defaults to csi, so the lock moves to this namespace even when the option was never directly configured. During a rolling nodeplugin upgrade the locks in both the default namespace and cephFS.radosNamespace are taken, so pods that have not been upgraded yet stay serialized against upgraded ones (#6539).

Features

Disaster Recovery

• GetReplicationDestinationInfo RPC: Added the GetReplicationDestinationInfo RPC to map source volume/volume-group IDs to destination IDs across mirrored clusters, enabling DR orchestrators to discover the correct destination volume IDs when pools have different IDs across clusters. Supports volume and volume-group replication, pool name-based mapping via the replicationDestination ConfigMap, and backward compatibility with existing cluster-mapping.json via ClientProfileMapping (#6316, #6366)

RBD

• cgroup v2 QoS support: Added cgroup v2 based QoS support for RBD volumes, including krbd, with QoS restored when regenerating the PV omap (#6274, #6343, #6529)
• Asynchronous NodeGetVolumeStats: Added async health checks to NodeGetVolumeStats for filesystem-mode volumes to avoid blocking on unresponsive mounts (#6382)
• Faster trash removal: Replaced the O(n) trash list scan with O(1) ID-based trash removal (#6472)
• Read-only image opens: Snapshot metadata and getUsedBytes/DiffIterate operations now open images read-only (#6306, #6401, #6509, #6536)

CephFS

• MDS pinning via ControllerModifyVolume: Support pinning a subvolume to an MDS via ControllerModifyVolume, using go-ceph PinSubVolumeInGroup() (#6390, #6508)
• fscrypt lock moved to the CephFS RADOS namespace for encrypted volumes (see NOTE above) (#6539)
• Asynchronous NodeGetVolumeStats: Avoid a hanging os.Stat() in NodeGetVolumeStats after a restart (#6418)

NFS

• Friendly export names: Added a friendlyExportNames StorageClass parameter. When "true" and the external-provisioner runs with --extra-create-metadata=true, NFS-exports are named <namespace>/<pvc-name> instead of the generated volume ID (off by default). CreateVolume fails with AlreadyExists rather than silently reusing another volume's export if the name is already claimed (#6497)
• VolumeGroupSnapshot support (#6392)
• Modify clients via VolumeAttributesClass: Allow modifying the clients parameter through VolumeAttributesClass (#6219)
• Asynchronous NodeGetVolumeStats health checks (#6383)

NVMe-oF

• External client support for NVMe-oF (#6251)
• Volume cloning capability (#6277)
• VolumeGroupSnapshot support (#6434)
• DH-CHAP hardening: Gate DH-CHAP on kernel support and make node DH-CHAP auth get-only (#6301, #6396)

Build

• Rocky Linux 10 base image: The cephcsi container image is now built on Rocky Linux 10 (#6413), with a slimmer image build (#6310)

What's Changed

RBD

• Fix connection leak when a non-nil volume is returned (#6432)
• Add missing rbdVol.Destroy() in replication handlers (#6451)
• Fix healer staging path for Block volumeMode (#6257)
• Include trashed parents in clone depth checks (#6500)
• Skip flatten for ROX snapshot restores (#6534)
• Skip DiffIterate for block volume stats without object-map (#6442)
• Remove snapshot lock from restore path (#6354)
• Return InvalidArgument for unrecognized QoS (#6457)
• Add isClone(), rbdVolume.Delete() and move temp image cleanup (#6481)
• Add debug logging to ProcessMetadata for CBT diagnostics (#6203)

CephFS

• Refresh recursive stats before volume stats (#6501)
• Validate subvolumeName before setting metadata (#6499)
• Remove redundant client eviction in fencing workflow (#6409)

NVMe-oF

• Simplify nvme dis/connect (#6526)
• Simplify subsystem deletion (#6533)
• Move QoS and host parsing into dedicated types/files (#6391)
• Change the returned error code (#6535)

Common

• Return InvalidArgument for undecodable volume IDs in DeleteVolume (rbd, cephfs) (#6490)
• Improve static PV handling (#6328)
• Skip volume ID format check for pre-provisioned volumes (#6355)
• Fix stripSecret re-appending the secret it redacted (#6444)
• Optimize key rotation flow for cryptsetup (#6137)
• Fix wrong key size for DEKStoreIntegrated (#6344)
• Fix IPv6 address handling in blocklist operations (#6317)
• Use omap get-by-keys for direct lookups and lower not-found log level (#6341, #6356)
• Watch VGRC metadata to reduce memory usage (#6345)
• Make health-check error message static (#6540)
• Validate unknown parameters in ControllerModifyVolume (#6458)
• Use CSI Server interfaces for CephFS & NFS (#6304)
• Use read-only image opens (#6536)

Continuous Integration and Testing

• Start testing with Kubernetes 1.36 (#6305, #6319)
• Use Rook v1.19.9 with new Ceph key format support (#6487)
• Add an acceptance minikube quick e2e smoke gate (#6437)
• Add snapshot metadata e2e tests for RBD, snapshot test for NVMe-oF, and NVMe-oF VAC test (#6459, #6438, #6276)
• Migrate VolumeGroupSnapshot API from v1beta2 to v1 (#6388)
• Implement setEnableFencing for OperatorDeployment (#6452)
• Create the configmap before deploying the CSI plugins and create missing StorageClass (#6513, #6561)
• Remove helm tests (#6512)
• Add unit tests for volume info stash utils (#6454)
• Merge-queue and Mergify improvements (#6348, #6408, #6402, #6453, #6504, #6549, #6560); serialize/revert merge-queue CI serialization (#6359, #6431)

Deployment

• Update CSI sidecars to the latest versions available (#6329, #6555)
• Use a single worker thread in csi-provisioner for NVMe-oF (#6538)
• Add CephNFS to the Rook e2e test cluster (#6515)

Helm Charts

• CephFS: fix nodeplugin secrets RBAC for metadata KMS (#6464)

Documentation

• Add design for replicationDestinationInfo (#6316)
• Add network fencing documentation for CSI-Addons (#6393)
• Add reclaimspace documentation to the index (#6403)
• Mark fsName as required for CephFS static PV (#6494)
• Publish documentation through GitHub Pages, enable emoji images, and improve doc linking/references (#6380, #6394, #6395, #6466)
• Add note about containerized-test execution time (#6349)

Build and Cleanups

• Add verbose build output in CI environments (#6357)
• Update golangci-lint (#6532)

Updates of dependencies

• Bump k8s.io/kubernetes to 1.36.3 and k8s.io/api to 0.36.2 (#6336, #6338, #6422, and others)
• Bump github.com/ceph/go-ceph from 0.39.0 to 0.41.0 (#6351, #6479)
• Bump google.golang.org/grpc to 1.83.2 (#6386, #6407, #6450, #6544, and others)
• Bump github.com/ceph/ceph-nvmeof/lib/go/nvmeof (#6389)
• Bump go.opentelemetry.io/otel/sdk to 1.45.0 (#6566)
• Multiple other updates across the k8s-dependencies, github-dependencies, and golang-dependencies groups

New Contributors

• @ismaelpuerto made their first contribution in #6310
• @rewantsoni made their first contribution in #6316
• @YLShiJustFly made their first contribution in #6257
• @SanjalKatiyar made their first contribution in #6383
• @shatadru made their first contribution in #6413
• @somanchi004-code made their first contribution in #6444
• @donch made their first contribution in #6464
• @sandaruwijewardhana made their first contribution in #6508
• @cynthiaantonyj made their first contribution in #6532
• @IanEff made their first contribution in #6515
• @fallmo made their first contribution in #6490
• @baldugus made their first contribution in #6501

Full Changelog: v3.17.0...v3.18.0