piraeusdatastore/piraeus-operator v2.12.0

on GitHub

We are happy to announce a new feature release of our Operator!

The Operator now supports shared LVM storage pools: setting lvmPool.sharedSpace registers a Volume Group backed by storage that is shared between nodes, for example a SAN. With lvmPool.externalLocking you can additionally hand locking over to an external lock manager such as lvmlockd instead of relying on LINSTOR's internal locking.

Rotating TLS certificates no longer requires manual intervention. With internalTLS or apiTLS enabled, the Satellite and Controller containers now restart on their own once a new certificate is issued.

We also tightened the permissions Piraeus asks for: neither the Operator nor the CSI Controller has cluster-wide access to Secrets any more. If you back up snapshots to S3, you need to grant access to the credentials Secret explicitly before upgrading, otherwise snapshot operations will fail. The upgrade guide has the exact steps, and there is a new how-to on S3 backups.

Two more things to be aware of when upgrading: the minimum supported Kubernetes version is now v1.30, and the CSIDriver now uses fsGroupPolicy: File, which means a Pod's fsGroup is applied to ReadWriteMany volumes in Filesystem mode as well. Both are covered in the upgrade guide.

Rounding it off are the usual component updates - LINSTOR 1.35.2, LINSTOR CSI 1.13.1, DRBD 9.3.4 and the latest CSI sidecars — plus fixes for merging the host's LVM configuration into the Satellite and for the LINSTOR Controller's periodic database export.

Added

• Support shared LVM storage pools: setting lvmPool.sharedSpace registers the storage pool as backed by storage
  shared between nodes, optionally using an external lock manager such as lvmlockd (lvmPool.externalLocking).
• Support rotation of Satellite TLS certificates: with internalTLS enabled, the Satellite container will restart
  to pick up a rotated certificate.
• Support rotation of Controller TLS certificates: with internalTLS or apiTLS enabled, restarting the Controller
  container to pick up a rotated certificate.

Changed

• The minimum supported Kubernetes version is now v1.30.
• Set fsGroupPolicy: File on the CSIDriver, so fsGroup is also applied to ReadWriteMany volumes in Filesystem
  mode.
• Updated images:
  • LINSTOR 1.35.2
  • LINSTOR CSI 1.13.1
  • DRBD 9.3.4
  • Latest CSI sidecars

Removed

• Removed the cluster-wide permission to read Secrets from the CSI controller: access to Secrets referenced in a VolumeSnapshotClass, such as S3 credentials, now needs to be granted explicitly.
• Removed the cluster-wide permission to read and modify Secrets from the Operator: it now manages Secrets only in its own namespace, using a namespaced Role.
• Removed the deprecated csi-health-monitor sidecar (csi-external-health-monitor-controller) from the CSI controller
  deployment, along with its RBAC rules and default image.

Fixed

• Actually merge the host's lvm.conf and lvmlocal.conf into the LVM configuration used by the satellite, and copy over LVM profiles from the host.
• Mount an emptyDir volume at /var/lib/linstor in the LINSTOR Controller, so the periodic database export works
  with the read-only root filesystem.