Update Helm release ceph-csi-rbd to v3.17.1 (main)

Sylva Renovate botrequested to merge
renovate/main-ceph-csi-rbd-3.x into main

This MR contains the following updates:

Package Update Change
ceph-csi-rbd (source) minor 3.15.1 -> 3.17.1

⚠️ Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

ceph/ceph-csi (ceph-csi-rbd)

v3.17.1

Compare Source

[!IMPORTANT] Updated Ceph Base Image with AES256 Key Support

The v3.17.1 ceph-csi image includes an updated Ceph base image (v20.2.4) that provides AES256 key format support. This resolves authentication issues when connecting to Ceph clusters using the newer AES256k key format (#​6493).

Kernel Requirements: AES256 key support requires Linux kernel 7.0 or later (backported to CentOS Stream 9 and 10). For more details, see the Ceph v20.2.4 release announcement.

[!WARNING]

  • Ceph Tentacle v20.2.0 may have data loss with CephFS when readAffinity is enabled. Refer to #​5772 for more details.
  • Migration: Ceph-CSI v3.17+ officially recommends using Ceph-CSI-Operator as the supported deployment mechanism. Refer to Migration.md for more details.

What's Changed

Bug Fixes
CI/Testing Improvements

Full Changelog: https://github.com/ceph/ceph-csi/compare/v3.17.0...v3.17.1

v3.17.0: Ceph-CSI v3.17.0 Release

Compare Source

We are excited to announce another release of Ceph CSI, v3.17.0. This is another significant step towards using enhanced Container Storage Interface (CSI) features with Ceph Cluster in the backend. With this release, we are introducing many brand-new features and enhancements to the Ceph CSI driver. Here are the changelog/release highlights.

Changelog and Highlights:

[!WARNING]

  • Migration: Ceph-CSI v3.16+ officially recommends using Ceph-CSI-Operator as the supported deployment mechanism. Refer to Migration.md for more details.
  • Breaking Change: NFS CSIDriver object's spec.attachRequired is now set to true to accommodate the Kubernetes ServiceAccount based volume access restriction feature. Users upgrading to v3.17 will need to delete and recreate the CSIDriver object for NFS.
  • Breaking Change: NVMe-oF StorageClass now requires publish secrets to accommodate the Kubernetes ServiceAccount based volume access restriction. Users upgrading to v3.17 will need to recreate the NVMe-oF StorageClass with publish secrets.

NOTE

  • The --setmetadata flag has been deprecated and has no effect. Metadata is now always set on RBD images and CephFS subvolumes. The flag will be removed in a future release (#​6225).

Features

Kubernetes ServiceAccount Based Volume Access Restriction

This release introduces ServiceAccount based volume access restriction across all drivers (RBD, CephFS, NFS, NVMe-oF), enabling fine-grained access control for volumes based on Kubernetes ServiceAccount identity. Refer to the design proposal and #​6076 for more details.

RBD
  • VolumeAttributesClass QoS: Use VolumeAttributesClass feature to implement RBD volume QoS via ControllerModifyVolume, allowing dynamic QoS parameter changes without recreating volumes (this is only supported for nbd mounter) (#​6160)
  • StorageClass image features for temp clones and snapshots: Temp clones and snapshot backing images now use StorageClass image features (#​6205)
  • Fix missing data pool in PVC restore and clone images: Fixed data pool not being set correctly during PVC restore and clone operations (#​6086)
  • DiffIterateByID fix: Fixed Length calculation in DiffIterateByID (#​6200)
  • PV metadata updates: Update PV metadata on volumes (#​6059)
  • Enable WholeObject & IncludeParent in snap diff (#​6279)
  • GKLM KMS over KMIP: Added support for GKLM (Guardium Key Lifecycle Manager) KMS over KMIP protocol (#​6048)
CephFS
  • VolumeGroupReplication RBAC: Added RBAC for VolumeGroupReplication resources (#​6233)
  • CSI metadata on subvolumes: Added SetSubVolCSIMetadata to set CSI metadata on subvolumes (#​6174)
  • Improved unfencing: Use RemoveNetworkFence directly for unfencing (#​6278)
NFS
  • ControllerModifyVolume: Allow changing NFS-server hostname through ControllerModifyVolume (#​5829)
NVMe-oF
  • DH-CHAP authentication: Added DH-CHAP authentication support for NVMe-oF connections, enabling secure host authentication at both controller publish and node stage levels (#​5913)
  • Snapshot support: Relay CreateSnapshot/DeleteSnapshot to RBD backend for NVMe-oF volumes (#​5928)
  • Auto listeners: Added auto listener feature for NVMe-oF gateway listeners (#​5891)
  • Safe controller disconnect: Implemented safe controller disconnect logic with device tracking (#​6163)
  • Mount cache and locking: Added mount cache and GroupLock for safe NVMe disconnect during stage/unstage operations (#​6192, #​6210)
  • Namespace masking: Added namespace masking calls for NVMe-oF (#​6241)
  • Optional gateway port: Made nvmeofGatewayPort an optional StorageClass parameter (#​6230)
  • IP address resolution: Support resolving IP address for NVMe-oF gateway listeners by hostname (#​6061)
  • GroupLock utility: Added GroupLock for two-group mutual exclusion (#​6183)
Common
  • VolumeID validation: Added validator for VolumeID in incoming gRPC requests (#​5957)
  • Allow underscores in volume ID: Volume IDs now support underscores (#​6094)
  • Slow gRPC restart: The CSI driver process is now automatically restarted if any unary gRPC call is stuck for more than 10 minutes. ReclaimSpace calls are excluded from this limit. Use --feature-gates=SlowGRPCRestart=false to disable (#​6286)
  • VolumeLocks for NodeGetVolumeStats: Added VolumeLocks to NodeGetVolumeStats for RBD and CephFS (#​6291)

What's Changed

NVMe-oF
  • Fix CSI node plugin crash on immutable Linux distributions (#​6165)
  • Fix NVMe-oF resource cleanup on CreateVolume failure (#​5936)
  • Fix removeHost bug (#​6084)
  • Fix dhchap key-value bug in rbd metadata (#​6085)
  • Add check return status at removeHost (#​6124)
  • Treat "connecting" state as valid in path detection (#​5974)
RBD
  • Revert "rbd: fetch the volumeIds from VGRContent's status for omap data" (#​5962)
  • Validate mounter type in ControllerModifyVolume (#​6229)
Other
  • Use go-ceph blocklist APIs (#​6054)
  • Use csi objectuuid for rados locks (#​6204)
  • Include stderr in cryptsetup errors (#​6036)
  • Disable informers on secrets (#​5984)
Continuous Integration and Testing
  • Start testing the devel branch with Kubernetes 1.35 (#​5973)
  • Use Rook 1.19.3 and Ceph Tentacle (#​5672)
  • Use minikube v1.38.0 and v1.38.1 (#​5993, #​6138)
  • Enable NVMe-oF testing by default (#​5641)
  • Add volume expansion tests for NVMe-oF (#​6058)
  • Enable fail-fast to abort suite on first test failure (#​6088)
  • Convert By() to It() and use Ordered containers (#​6136)
  • Add markdown links validation action (#​6092)
  • Cache mon IPs, clusterID, and parallelize readiness checks (#​6114)
  • Add testing for EC pool (#​6086)
  • Update ceph-csi-operator API from v1alpha1 to v1 (#​6218)
  • Upgrade from v3.16.0 for upgrade tests (#​5932)
Deployment
  • Add deployment files for NVMe-oF (#​5641)
  • Update CSI sidecars to latest versions available (#​6112)
  • Use GA versions of sidecars everywhere (#​6189)
  • Add SecurityContextConstraints to NVMe-oF ServiceAccounts (#​6249)
  • Add RBAC for csi-provisioner to access VolumeAttributesClass (#​6160)
  • Allow NFS-provisioner to access VolumeAttributesClasses (#​5829)
Helm Charts
  • Fix domainLabels empty array handling in template (#​5990)
Documentation
  • Add design proposal for K8s SA based volume access restriction (#​6076)
  • Add NVMe-oF DH-CHAP feature doc design (#​6063)
  • Document current NVMe-oF features (#​6065)
  • Add documentation for GKLM KMS (#​6048)
  • Add examples for NVMe-oF and NVMe-oF snapshots (#​5641)
  • Update QoS design doc and VolumeAttributesClass documentation (#​6264)
  • Mention encryption is not supported for static PVC (#​6212)
  • Add AGENTS.md with guidance for AI agents (#​6181)
  • Fix broken links in docs (#​6082)
Build and Cleanups
  • Adapt to go-ceph 0.38.0 and 0.39.0 blocklist API changes (#​6069, #​6245)
  • Add go-lint-fix Makefile target for golangci-lint autofix (#​6208)
  • Deprecate the --setmetadata flag from configuration (#​6225)
  • Refactor tryAcquire function to reduce complexity (#​6115)
  • Use SetWriteDeadline for writeTimeout (#​6115)
  • Fix encryptedMetedataDEK typo (#​6115)
Updates of dependencies

New Contributors

Full Changelog: https://github.com/ceph/ceph-csi/compare/v3.16.0...v3.17.0

v3.16.2: Ceph-CSI v3.16.2 Release

Compare Source

[!WARNING]

  • Ceph Tentacle v20.2.0 may have data loss with CephFS when readAffinity is enabled. Refer to #​5772 for more details.
  • Migration: Ceph-CSI v3.16+ officially recommends using Ceph-CSI-Operator as the supported deployment mechanism. Refer to Migration.md for more details.

What's Changed

Full Changelog: https://github.com/ceph/ceph-csi/compare/v3.16.1...v3.16.2

v3.16.1: Ceph-CSI v3.16.1 Release

Compare Source

[!WARNING]

  • Ceph Tentacle v20.2.0 may have data loss with CephFS when readAffinity is enabled. Refer to #​5772 for more details.
  • Migration: Ceph-CSI v3.16+ officially recommends using Ceph-CSI-Operator as the supported deployment mechanism. Refer to Migration.md for more details.

What's Changed

Full Changelog: https://github.com/ceph/ceph-csi/compare/v3.16.0...v3.16.1

v3.16.0: CephCSI v3.16.0 Release

Compare Source

We are excited to announce another release of Ceph CSI, v3.16.0. This is another significant step towards using enhanced Container Storage Interface (CSI) features with Ceph Cluster in the backend. With this release, we are introducing many brand-new features and enhancements to the Ceph CSI driver. Here are the changelog/release highlights.

Changelog and Highlights:

[!WARNING]

  • Ceph Tentacle v20.2.0 may have data loss with CephFS when readAffinity is enabled. Refer to #​5772 for more details.
  • Migration: Ceph-CSI v3.16+ officially recommends using Ceph-CSI-Operator as the supported deployment mechanism. Refer to Migration.md for more details.

Features

NVMe-oF (NEW and Experimental)

The Deployment of NVMe-oF driver will be supported by Ceph-CSI-Operator soon.

This release introduces the NVMe-oF CSI driver, enabling Ceph storage to be accessed over the NVMe over Fabrics protocol. Refer to NVMe-oF.md and #​5370 for more details.

RBD
  • Block volume statistics support: Added ability to retrieve block volume usage statistics (#​5799)
  • Configurable block encryption cipher: Made the encryption cipher configurable for block volumes (#​5711)
  • Improved fencing logic: Modified fencing logic for RBD and CephFS volumes (#​5828)
CephFS
  • Improved fencing logic: Modified fencing logic for RBD and CephFS volumes (#​5828)
Other
  • Controller publish secret caching: Added caching for controller publish secrets to improve performance (#​5497)
  • User ID metadata storage: Store user ID in volume metadata (#​5445)
  • IPv6 support improvement: Support for compressed IPv6 addresses in ParseClientIP (#​5547)

What's Changed

CephFS
  • Skip reset quiesce during DeleteVolumeGroupSnapshot (#​5583)
  • Fix mounting of alternate filesystem when mounting by monitor list (#​5643)
RBD
  • Fix fencing for shallow volumes (#​5503)
  • Fix volume replication promote/demote failures (#​5533)
  • Volume demote after unpublish call (#​5567)
  • Remove forcePromote function (#​5725)
  • Prevent panic when expanding a statically provisioned volume (#​5786)
  • Fetch volumeIds from VGRContent's status for omap data (#​5899)
Continuous Integration and Testing
  • Prevent running multiple e2e suites at the same time (#​5537)
  • Let Mergify label NVMe-oF MRs (#​5563)
  • Use ceph-csi-bot for Mergify actions (#​5584)
  • Set update_bot_account in Mergify config (#​5586)
  • Use minikube v1.37.0 (#​5598)
  • Update CI rules for Kubernetes 1.34 (#​5602)
  • Auto-detect running on OpenShift (#​5617)
  • Add NVMe-oF gateway deployment (#​5614)
  • Use gci in golangci-lint (#​5676)
  • Update static tools in the repo (#​5680)
  • Prevent Mergify from triggering CI jobs twice (#​5734)
  • Deploy ceph-csi-operator in configurable Namespace (#​5867)
  • Fix pushing artifacts to quay.io (#​5896)
Deployment
  • Update CSI sidecars to latest versions available (#​5421)
  • Add list and watch permissions for secrets (#​5809)
Helm Charts
  • Inject POD_NAMESPACE for KMIP secret lookup (#​5722)
  • Add support for optionally injecting labels for VolumeSnapshotClass (#​5843)
  • Claim ownership of the ArtifactHub repository (#​5906)
  • Use repository-id instead of name for ArtifactHub (#​5921, #​5923)
Documentation
  • Update docs & Mergify rules to prepare for v3.16 release (#​5912)
  • Fix link for CephFS helm doc (#​5851)
Build and Cleanups
  • Use Go 1.24.6 (#​5781)
  • Use github.com/avast/retry instead of kubernetes/wait (#​5511)
  • Add modprobe helper for loading kernel modules (#​5564)
  • Remove duplication code of k8s GetSecret (#​5603)
  • Introduce a Driver interface for Run() function (#​5636)
  • Move k8s API calls to internal/util/k8s (#​5604)
  • Retry controllerpublish secret fetch on missing clusterId (#​5677)
  • Add explicit nil check before errors.Is(err) check (#​5692)
  • Fix cache miss when secret watcher is not running (#​5807)
  • Download Golang distribution from go.dev (#​5818)
  • Switch to tentacle base image (#​5856)
Updates of dependencies

New Contributors

Full Changelog: https://github.com/ceph/ceph-csi/compare/v3.15.1...v3.16.0

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻️ Rebasing: Whenever MR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this MR and you won't be reminded about this update again.

  • If you want to rebase/retry this MR, check this box

This MR has been generated by Renovate Bot Sylva instance.

CI configuration couldn't be handle by MR description. A dedicated comment has been posted to control it.

If no checkbox is checked, a default pipeline will be enabled (capm3, or capo if capo label is set)

Edited by Sylva Renovate bot

Merge request reports