Release Notes

v0.1.25

Release date: 2026-09-09

A node whose repositories cannot provide the iSCSI stack now gets it from the module’s own package image, a NetappStorageConnection decides how much of a volume is kept for the superuser — nothing, by default, where ext4 used to keep 5% — and the module controller exports metrics and takes its log level from a module setting.

Highlights

Changes in this release:

• The module installs open-iscsi and multipath-tools from its own package image when a node’s repositories cannot provide them. Such a node used to be left as it was, and every attach on it failed with nsenter: failed to execute iscsiadm.
• A NetappStorageConnection can ask for a share of the filesystem to be kept for the superuser — the classic ext4 reserve — with the storage.deckhouse.io/ext4-reserved-percent annotation. Volumes are formatted with no reserve unless it is asked for, where before every ext4 volume kept ext4’s default 5% for root.
• A restart of node-driver-registrar no longer wedges the node plugin. That deadlock left one or two nodes of a cluster without csi.trident.netapp.io in their CSINode, unable to attach a volume, while their siblings were fine.

New features

This release adds:

• A node whose package repositories cannot install open-iscsi and multipath-tools (iscsi-initiator-utils and device-mapper-multipath on RPM distributions) now gets them from the module’s own iscsi-tools package image: the payload lands under /var/lib/deckhouse/sds/csi-netapp, every binary runs against its own library path, and two units come up for the daemons, d8-csi-netapp-iscsid.service and d8-csi-netapp-multipathd.service. The distribution’s packages stay the preferred path and the two never mix — a node that has an iscsiadm of its own keeps everything of its own, because a client of one version does not speak to an iscsid of another. Everything the NodeGroupConfiguration does after the install runs on such a node exactly as on any other: the find_multipaths no override, the NetApp ONTAP device block, the kernel modules and the storage.deckhouse.io/csi-netapp-node-ready label the CSI node waits for.
• storage.deckhouse.io/ext4-reserved-percent on a NetappStorageConnection sets the percentage of the filesystem kept for the superuser: a whole number from 0 to 50, default 0. Note the resource — unlike the other storage modules of the fleet, the value is set per connection and not per StorageClass, because Trident keeps the mkfs options on the backend, so it applies to every StorageClass served by that connection. The reserve applies to volumes created afterwards; an existing filesystem keeps the reserve it was created with. An invalid value leaves the NetappStorageConnection with Ready=False and the reason in its status, instead of breaking volume creation later.
• The module setting logLevel sets how much the controller logs: ERROR, WARN, INFO, DEBUG or TRACE. It is INFO by default, where the controller used to log at DEBUG with no way to change it.
• The controller exports metrics and a PodMonitor puts them in front of the cluster’s main Prometheus: what controller-runtime reports for every controller of the module — reconcile counts and durations, workqueue depth, client-go latency. The controller binds its metrics endpoint on 127.0.0.1, and a kube-rbac-proxy in the same pod authorises every scrape.

Improvements

This release improves:

• Release notes are written per locale in .release-notes/<tag>.yaml and <tag>.ru.yaml with the sections summary, highlights, new_features, improvements, fixes, security, breaking, upgrade_notes, known_issues, docs and dependencies. Both locales reach the cluster, so the console shows the notes in the language of the reader; the releases cut before this one keep the previous flat format and render on the same page exactly as before.

Fixes

This release fixes:

• The formatOptions the module writes onto a Trident backend reach Trident at all now. They used to sit at the top level of the TridentBackendConfig spec, where the driver has no such field: Trident reads them from under defaults, so a value at the top level was parsed into nothing and dropped without a word. The -E nodiscard the module has always asked for was therefore never applied, and every volume was formatted with mkfs discarding the whole device.
• A restart of node-driver-registrar no longer takes the CSI driver with it. The csi-node liveness probe watched a port the registrar serves but was attached to the driver container, and the two deadlocked: the registrar exits by design when registration fails, its port goes with it, the probe kills the driver, the CSI socket disappears, and the restarted registrar can no longer reach it. A node came up with the node plugin wedged — a dozen restarts and no csi.trident.netapp.io in its CSINode, so no volume could be attached there — while other nodes of the same cluster were fine. The probe now sits on the container that serves it.
• A change to the multipath configuration no longer fails on a node where multipathd is enabled but not started: such a unit refuses a reload outright, and the node configuration step then retried forever, leaving the module’s find_multipaths no unapplied — which is what Trident’s own pre-flight checks read before they agree to stage a volume. The handler restarts the unit when it cannot reload it, and covers the module’s own d8-csi-netapp-multipathd.service as well.
• A release tag with no release notes used to publish an empty changelog.yaml, leaving ModuleRelease.spec.changelog blank with a green build. Such a tag now fails the build.

Upgrade notes

Before upgrading, note the following:

• Volumes created after the upgrade carry no reserve for the superuser, so the whole volume is available to the workload; a filesystem that already exists keeps the 5% it was created with. Nothing has to be done by hand — the controller rewrites the TridentBackendConfig of every connection on its own, and existing volumes and PVCs are not affected.
• The controller logs at INFO after the upgrade, where it used to log at DEBUG unconditionally. Set settings.logLevel to DEBUG or TRACE to get the previous verbosity back.
• A node whose csi-node pod was stuck in the registration deadlock recovers as the DaemonSet rolls out the fixed pod — no pod has to be deleted by hand.

Docs

Documentation changes:

• The module’s configuration page describes both ways the iSCSI stack reaches a node — the node’s own repositories and the module’s package image: which path is preferred and why, what the fallback puts on the node and where, how to tell from a node which of the two it took, and the two arrangements that stay invisible until a volume fails to mount.
• The same page describes the share of a volume kept for the superuser: the annotation, that it belongs on the connection rather than on a StorageClass, the range of values, and that the reserve applies only to volumes created afterwards.

v0.1.24

• Fix: the release image is no longer built from cache with an outdated changelog.yaml — git-mapping dependencies are bound to the install stage, where the file is copied
• Update base images to v2.1.4
• Internal build changes for the module

v0.1.23

• Bugfix: a successful NFS mount is no longer reported as a failure - the image now ships /etc/mtab (a symlink to /proc/self/mounts), without which mount returned exit code 16
• Bugfix: the controller is granted patch on events instead of list - a repeated event write is no longer denied by RBAC
• CVE fixes
• Base images updated to v2.1.2, Go to 1.26.6 and lib-helm to 1.72.14

v0.1.22

• Bugfix: the secret with credentials is created before the TridentBackendConfig that references it, otherwise Trident rejected the backend with the error “backend credentials not found”; When deleting, the order is reversed. At the same time, an early exit from reconcile was eliminated, in which Ready=True was published before the creation of the secret, StorageClass and VolumeSnapshotClass
• Update base images to v1.3.25, Go 1.26.5 and lib-helm to 1.72.13
• Internal changes: work with conditions has been transferred to the general library

v0.1.21

• The snapshot-controller module is no longer a required dependency: VolumeSnapshotClass is created only if the snapshot.storage.k8s.io CRD is present, otherwise NetappStorageClass and NetappStorageConnection are processed without the snapshot part
• Update base images, Go 1.26.5 and lib-helm to 1.72.12
• Fixed a vulnerability in gRPC (GHSA-hrxh-6v49-42gf)
• Internal changes in module assembly

v0.1.20

• Fix: Deckhouse registry access secrets are now limited to the active image source
• Update base images, Go 1.26.5 and lib-helm to 1.72.10
• Internal changes in module assembly

v0.1.19

• When forwarding labels from NetappStorageClass to StorageClass, labels with specified ignored prefixes are now excluded
• Update base images and lib-helm to 1.72.0

v0.1.18

• Labels from NetappStorageClass are now forwarded to the managed StorageClass Kubernetes
• Update base images, Go 1.25.10 and lib-helm 1.71.12

v0.1.17

• Internal changes in the structure and assembly of the module

v0.1.16

• Update base images, Go 1.25.10 and lib-helm 1.71.11
• Internal changes to the module assembly

v0.1.15

• Corrections to the module structure

v0.1.14

• csi-netapp has been transferred to the distroless build of Trident (host binaries via nsenter), the node plugin’s resistance to restarts has been increased
• Added status.conditions and printer columns to CRD NetappStorageClass and NetappStorageConnection
• Added NodeGroupConfiguration for installing iscsi/multipath on Altlinux, RedOS-like and Ubuntu-like
• Fixed vulnerabilities (CVE) in Trident binary dependencies

v0.1.13

• Changes in CI: DistroPackagesProxy and env proxy in werf, improvements to CVE scans (role_name, checkout)
• Added user-authz cluster roles in templates

v0.1.12

• Added missing mount points in the csi-netapp distroless image
• Update base images, Go and lib-helm (CVE fix)
• Clarifications in the documentation

v0.1.11

• Update base images and golang version
• Updated hooks that work when a module is removed
• Disabled Capacity request from k8s (CSI does not support issuing Capacity)
• Fixes in working with snapshots
• Changes in CSI work

v0.1.10

• Fix HA-mode, now it works correctly

v0.1.9

• Updated base images versions
• Fixes in docs

v0.1.8

• Updated Go version to 1.24.9
• Updated lib-helm to deckhouse_lib_helm-1.64.1

v0.1.7

• Added release notes

v0.1.6

• Added additional mountings for containerd v2 support

v0.1.5

• Added information about snapshot-controller requirement for module operation
• Added readonlyRootFilesystem for enhanced security

v0.1.4

• CVE fixes

v0.1.3

• Added fixes for containerd v2 support
• Added dependency on snapshot-controller

v0.1.1

• CVE closure
• Module refactoring, fixed manifest errors
• Documentation improvements