github rustfs/operator 0.0.6
on GitHub

35 minutes ago

RustFS Operator 0.0.6

RustFS Operator 0.0.6 adds Kubernetes restricted Pod Security support, Kubernetes STS, OpenShift compatibility, stronger Tenant validation, and substantial security and reconciliation hardening.

The default RustFS server image is now pinned to: 

rustfs/rustfs:1.0.0-beta.10

Highlights

  • Added Kubernetes Pod Security Standards restricted defaults for generated RustFS workloads.
  • Added Kubernetes STS with PolicyBinding authorization.
  • Added managed and externally supplied TLS support for STS.
  • Added OpenShift installation support with SCC-managed UID and FSGroup delegation.
  • Added configurable Kubernetes cluster DNS domains.
  • Expanded generated TLS SAN coverage.
  • Added validation for Tenant credentials, RPC authentication, KMS configuration, certificates, security contexts, PVC templates, and provisioning lifecycle.
  • Protected existing RustFS users during provisioning reconciliation.
  • Aligned the Operator binary, Helm chart, chart appVersion, and container image version at 0.0.6.
  • Changed the Helm chart to use immutable 0.0.6 Operator and Console image tags instead of the mutable latest tag.

Security improvements

  • Added restricted security defaults for generated RustFS Pods.
  • Rejected contradictory or unsafe root workload security configurations.
  • Applied Console authentication through an explicit protected API router.
  • Added admission limits for unauthenticated Console login and STS requests.
  • Required cryptographically strong Console session keys.
  • Rejected empty or invalid Tenant credential Secrets.
  • Disabled automatic ServiceAccount token mounting for generated RustFS workloads.
  • Removed legacy Tenant workload Roles and RoleBindings.
  • Bounded generated TLS SAN processing and HTTP metrics label cardinality.
  • Improved sensitive error and credential redaction.

Reliability and correctness

  • Made repeated blocked status updates idempotent.
  • Hardened leader-election loss and follower observation handling.
  • Tolerated transient Kubernetes node lookup failures while preserving Pod cleanup safety.
  • Protected existing RustFS users during provisioning reconciliation.
  • Corrected wrapped RustFS monitoring API responses.
  • Corrected STS SigV4 query encoding.
  • Limited STS web identity sessions to 12 hours.
  • Improved managed TLS certificate rotation and CA trust preservation.
  • Added Tenant finalizer RBAC required by Kubernetes and OpenShift admission.
  • Validated immutable PVC template fields using Kubernetes quantity semantics.
  • Revoked Console sessions on logout.
  • Prevented pool volume-count overflow.
  • Improved Secret and ConfigMap event routing for shared Tenant references.

Important upgrade notes

Important

Review the following behavior changes before upgrading an existing installation.

Apply CRDs before upgrading

Helm does not automatically upgrade CRDs already installed from a chart's crds/ directory.

Apply both CRDs before upgrading the Operator: 

kubectl apply --server-side --force-conflicts \
  --field-manager=rustfs-operator-crd-upgrade \
  -f https://raw.githubusercontent.com/rustfs/operator/0.0.6/deploy/rustfs-operator/crds/tenant-crd.yaml

kubectl apply --server-side --force-conflicts \
  --field-manager=rustfs-operator-crd-upgrade \
  -f https://raw.githubusercontent.com/rustfs/operator/0.0.6/deploy/rustfs-operator/crds/policybinding-crd.yaml

Tenant ServiceAccount access

The Operator removes legacy Tenant workload Roles and RoleBindings and renders: 

automountServiceAccountToken: false

Standard RustFS workloads do not require Kubernetes API access.

Custom sidecars or scripts that require Kubernetes API access must provide:

  • A user-owned ServiceAccount.
  • Least-privilege RBAC.
  • An explicitly projected ServiceAccount token.

This migration changes the StatefulSet Pod template and causes Tenant Pods to roll.

STS TLS default

sts.tls.auto now defaults to false.

Installations using STS must provide the configured TLS Secret containing:

  • tls.crt
  • tls.key
  • ca.crt

To continue using Operator-managed STS certificates, explicitly configure: 

sts:
  tls:
    auto: true

Clusters that do not enable STS are unaffected by this setting.

Console availability

The Console now runs as one replica with a Recreate deployment strategy because sessions are process-local.

During an Operator upgrade:

  • Expect a brief Console interruption.
  • Active Console sessions are invalidated.
  • Users must authenticate again after a restart or session Secret rotation.
  • RustFS S3 data-plane traffic is unaffected.

Custom RustFS images

Tenants that override the default RustFS image may need to explicitly acknowledge the resolved runtime image.

This prevents unverified or incompatible RustFS images from being deployed with the restricted RuntimeDefault seccomp profile.

Review custom images before upgrading, especially older RustFS images with incompatible io_uring behavior.

Default image changes

The Helm chart now defaults the Operator and Console image tags to Chart.appVersion.

Installing the 0.0.6 chart without an explicit image override therefore deploys: 

rustfs/operator:0.0.6

A Tenant without spec.image and without the TENANT_RUSTFS_IMAGE environment override uses: 

rustfs/rustfs:1.0.0-beta.10

Existing Tenants may roll if their resolved RustFS image or generated Pod template changes.

Rollback considerations

Before upgrading:

  • Back up Tenant resources.
  • Back up the current Helm values.
  • Back up the installed CRDs.
  • Record the currently deployed Operator and RustFS image digests.
  • Verify Tenant readiness and S3 read/write operations.

When rolling back:

  • Do not automatically downgrade CRDs.
  • Keep the newer CRD schema unless compatibility with the older Operator has been verified.
  • An older Operator may recreate legacy Tenant RBAC.
  • An older Operator may restore automatic ServiceAccount token mounting.
  • Rolling back may trigger another Tenant StatefulSet rollout.
  • Pin Operator and RustFS images independently.
  • Verify Tenant readiness and S3 read/write operations after rollback.

Published artifacts

Publishing this GitHub Release builds and publishes the Operator image to:

  • Docker Hub: rustfs/operator:0.0.6
  • GitHub Container Registry: ghcr.io/rustfs/operator:0.0.6
  • Quay.io: quay.io/rustfs/operator:0.0.6

Because 0.0.6 is a non-prerelease Operator release, the corresponding latest tags are also updated.

The Helm chart is published with: 

version: 0.0.6
appVersion: 0.0.6

Full changelog

0.0.5...0.0.6

Check out latest releases or
releases around rustfs/operator 0.0.6

Don't miss a new operator release

NewReleases is sending notifications on new releases.

Get notifications