Release Notes

v0.4.11

Release date: 2026-10-05

rpcbind and rpc.statd now always come from the module’s own package without the node’s package manager, the CSI driver moves to csi-driver-nfs v4.13.4, and access roles are added for the RBACv2 model of DKP 1.78.

Highlights

Changes in this release:

• The NodeGroupConfiguration no longer asks the node’s package manager for rpcbind and nfs-common/nfs-utils: the module’s nfs-tools package is installed on every node with the storage.deckhouse.io/csi-nfs-node label, and it provides only the daemons the host lacks. Nodes without access to the distribution’s repositories no longer wait out the package manager on every bashible run.
• The CSI driver is updated from csi-driver-nfs v4.12.1 to v4.13.4.
• On DKP 1.78 and later the module ships the roles d8:system-capability:csi-nfs:view and d8:system-capability:csi-nfs:edit of the new RBACv2 model for NFSStorageClass.

New features

This release adds:

• On DKP 1.78 and later the module creates the ClusterRoles d8:system-capability:csi-nfs:view (read NFSStorageClass) and d8:system-capability:csi-nfs:edit (create, update and delete NFSStorageClass), aggregated into the manager role of the storage subsystem through rbac.deckhouse.io/kind: capability and rbac.deckhouse.io/scope: system. On DKP below 1.78 the existing d8:manage:permission:module:csi-nfs:view and d8:manage:permission:module:csi-nfs:edit roles are created unchanged.

Improvements

This release improves:

• The nfs-tools package decides for rpcbind and rpc.statd separately: a node that has rpcbind of its own but no nfs-common/nfs-utils now gets the module’s rpc.statd, ordered after the distribution’s portmapper. A daemon the host already has stays the host’s, and the unit and the sm-notify link that an earlier version of the module left for it are removed.
• When the tools on a node change after the package was installed (the host lost rpcbind or rpc.statd, or a distribution package with one of them was installed later), the NodeGroupConfiguration runs the package’s install again on the next bashible run instead of waiting for the next module release.

Fixes

This release fixes:

• rpcbind and rpc.statd from the nfs-tools package no longer fail to start on nodes without /etc/netconfig, such as a fresh Ubuntu 24.04: the install now puts the package’s netconfig there and removes it on uninstall. Previously the install failed and the csi-node Pod waited for /run/rpcbind.sock forever.
• Prometheus can scrape the metrics of csi-nfs-scheduler-extender again: its kube-rbac-proxy got the permissions to authenticate requests, the permanent TargetDown alert for it is gone.

Security updates

Security updates in this release:

• In the CSI driver (csi-nfs) github.com/opencontainers/runc is raised from v1.2.9 to v1.3.6 and github.com/google/cel-go from v0.22.0 to v0.29.0, which removes CVE-2026-41579 and GHSA-gcjh-h69q-9w9g from the image scan results. The vulnerable code was not compiled into the driver.

Upgrade notes

Before upgrading, note the following:

• After the update bashible installs the nfs-tools package on every node with the storage.deckhouse.io/csi-nfs-node label and stops installing rpcbind and nfs-common/nfs-utils from the distribution’s repositories. Packages already installed on a node stay and keep serving it; nothing needs to be done by hand.
• On DKP 1.78 and later the d8:manage:permission:module:csi-nfs:view and d8:manage:permission:module:csi-nfs:edit roles are no longer created, d8:system-capability:csi-nfs:view and d8:system-capability:csi-nfs:edit take their place. A ClusterRoleBinding that refers to an old role by name has to be pointed at the new one; access granted through the storage subsystem’s manager role carries over by itself. On DKP below 1.78 nothing needs to be done.

Docs

Documentation changes:

• The FAQ section on rpcbind and rpc.statd describes where each daemon on a node comes from, how to tell them apart, and why the package’s netconfig is placed in /etc/netconfig.

Dependencies

Dependency updates:

• csi-driver-nfs: 4.12.1 → 4.13.4 (changelog)
  • Stale NFS mounts are detected and remounted in NodePublishVolume; restoring a volume from a snapshot preserves file timestamps and rejects path traversal and symlink attacks in the archive; the server and share of a VolumeSnapshotClass no longer override those of the source volume; volume IDs are validated.

v0.4.10

Release date: 2026-09-24

Security update: the CSI driver and the module’s hooks are rebuilt against patched grpc and x/crypto.

Highlights

Changes in this release:

• google.golang.org/grpc is raised from v1.82.1 to v1.83.2 in the CSI driver (csi-nfs), closing CVE-2026-84303, CVE-2026-84304 and CVE-2026-84445.

Security updates

Security updates in this release:

• google.golang.org/grpc is raised from v1.82.1 to v1.83.2 in the CSI driver (csi-nfs), closing CVE-2026-84303, CVE-2026-84304 and CVE-2026-84445.
• golang.org/x/crypto is raised from v0.53.0 to v0.57.0 in the CSI driver (csi-nfs) and the module’s hooks (go-hooks), closing CVE-2026-56854 (authentication bypass by source address in x/crypto/ssh), CVE-2026-56855 and CVE-2026-78662.

v0.4.9

Release date: 2026-09-14

Prometheus can scrape the controller metrics again, and a node whose repositories have no NFSv3 userspace now gets it from the module instead of leaving every NFSv3 volume waiting forever.

Highlights

Changes in this release:

• Where a node’s package manager cannot install rpcbind and nfs-common/nfs-utils, the module installs the two daemons from its own nfs-tools image. Without them the CSI node Pod never starts on that node and every NFSv3 mount waits forever.
• The kube-rbac-proxy in front of the controller metrics is authorized to check scrapes again: since the metrics moved behind it, every scrape was refused and the controller target stayed down in Prometheus.

New features

This release adds:

• On a node whose repositories cannot provide rpcbind and nfs-common/nfs-utils, the NodeGroupConfiguration falls back to the module’s own nfs-tools package image: the payload is unpacked under /var/lib/deckhouse/sds/csi-nfs and the daemons come up as d8-csi-nfs-rpcbind.service and d8-csi-nfs-rpc-statd.service. The distribution’s packages stay the preferred path and a node that already has rpcbind of its own is left untouched. This concerns NFSv3 only, so it applies to clusters with v3support: true; NFSv4 needs neither daemon. The install step now also fails the bashible step when the portmapper socket does not answer, instead of reporting success and leaving the node with mounts that hang.

Improvements

This release improves:

• The default logLevel is now INFO instead of DEBUG, which is what a cluster that never set it explicitly will get.

Fixes

This release fixes:

• Prometheus could not scrape the module controller: the kube-rbac-proxy in front of its metrics was not allowed to create the TokenReview and SubjectAccessReview that every scrape is authorized with, so all scrapes were refused and the target stayed down. Clusters running v0.4.8, where the metrics moved behind the proxy, are the ones affected.
• rpc.statd from the module’s own package can reach sm-notify and no longer starts on an empty state file, so a node that has rebooted announces the reboot to the peers holding NFSv3 locks on it.

Upgrade notes

Before upgrading, note the following:

• Nothing has to be done by hand. The controller target in Prometheus recovers on its own once the updated controller is rolled out, and the NFSv3 fallback only touches nodes where the distribution packages cannot be installed.
• A cluster that relied on the previous default verbosity should set logLevel: DEBUG in the module configuration explicitly, because the default is now INFO.

v0.4.8

Release date: 2026-09-07

The metrics of the controller and of the scheduler extender are now published through a kube-rbac-proxy and scraped by Prometheus, and every component logs in the shared structured format.

Highlights

Changes in this release:

• The controller and the scheduler extender no longer serve their metrics unauthenticated: each binds on 127.0.0.1 and a kube-rbac-proxy in the same pod publishes them over TLS, behind an authorization check.
• The metrics of the scheduler extender — reconcile counts, workqueue depth, Go runtime — reach Prometheus for the first time, through a new PodMonitor.

New features

This release adds:

• A PodMonitor named csi-nfs-scheduler-extender makes the metrics of the scheduler extender available in Prometheus. It is created only where the PodMonitor kind exists, so a cluster without monitoring is unaffected.

Improvements

This release improves:

• The controller, the scheduler extender and the webhooks moved onto the shared logger of the storage modules: messages carry structured key=value fields and the name of the component that wrote them, instead of the [main]-style prefixes. Anything that parses these logs by their old shape has to be adjusted.
• The kube-rbac-proxy of the scheduler extender has no readiness probe on purpose: a sidecar that only serves metrics must never be able to stop the kube-scheduler from calling the extender.

Fixes

This release fixes:

• The ServiceMonitor of the controller is now created whenever the ServiceMonitor kind is present, not only when the operator-prometheus-crd module is listed as enabled. Its metrics — including the validity of the RPC-with-TLS certificates, which nothing in this module rotates — used to stay unscraped in a converge that had only just applied the Prometheus operator CRDs.
• The VerticalPodAutoscaler of the scheduler extender is gated the same way, so it is no longer skipped in a converge that installs the VPA CRDs alongside the module.

Security updates

Security updates in this release:

• The metrics endpoints of the controller and of the scheduler extender are no longer reachable on the pod IP without credentials. Scraping them now requires get on deployments/prometheus-metrics for d8-csi-nfs-controller and csi-nfs-scheduler-extender respectively.

Upgrade notes

Before upgrading, note the following:

• Nothing has to be done by hand: the ServiceMonitor shipped by the module is updated with it, and the new PodMonitor appears on its own.
• The metrics port of the controller Service is renamed from metrics to https-metrics and now speaks HTTPS. Any scrape configuration of your own that pointed at the plain-HTTP port has to be pointed at the proxy and given the Prometheus token.

v0.4.7

• Fix: the release image is no longer built from cache with an outdated changelog.yaml — git-mapping dependencies are bound to the install stage, where the file is copied
• Internal build changes for the module

v0.4.6

• Bugfix: a successful mount is no longer reported as a failure - the image now ships /etc/mtab (a symlink to /proc/self/mounts), without which mount returned exit code 16. The wrap-mount wrapper that used to mask this error has been removed
• Bugfix: the VPA is switched from the deprecated Auto update mode to InPlaceOrRecreate
• Bugfix: the controller is granted patch on events instead of list - a repeated event write is no longer denied by RBAC
• Expiry metrics for the RPC-with-TLS certificates - csi_nfs_tls_certificate_not_after_timestamp_seconds and csi_nfs_tls_certificate_not_before_timestamp_seconds, one series per certificate from the tlshd-conf ConfigMap - and three alerting rules: CsiNfsTLSCertificateExpiringSoon (less than 14 days left), CsiNfsTLSCertificateExpired and CsiNfsTLSCertificateNotYetValid
• Base images updated to v2.1.2, Go to 1.26.6 and lib-helm to 1.72.14
• CVE fixes

v0.4.5

• Bugfix: optional resources (for example, scheduler-extender) are now included based on the presence of the corresponding CRD, and not on the list of modules
• Internal changes in module assembly

v0.4.4

• NFSStorageClass publishes status.conditions and status.observedGeneration; the Ready condition indicates whether the controller has applied the current specification; a Ready column has been added. The status.phase field retains the same set of values ​​and its column
• Correction: the condition message is truncated to a valid schema length - otherwise the API server would reject the status record
• Updating base images to v1.3.25 and lib-helm to 1.72.13

v0.4.3

• The snapshot-controller module is no longer a required dependency: VolumeSnapshotClass (general and for each NFSStorageClass) is created only if the CRD snapshot.storage.k8s.io is available, otherwise NFSStorageClass is processed without the snapshot part
• Updating base images, Go 1.26.5 and lib-helm to 1.72.12
• Fixed a vulnerability in gRPC (GHSA-hrxh-6v49-42gf)
• Internal changes in module assembly

v0.4.2

• Fixed tlshd startup: The wrapper uses the installation paths of the ktls-utils package, so the net-handshake-checker containers in csi-controller and csi-node no longer crash with the error “no such file or directory”
• Fixed NFSv3 mounts: the /etc/netconfig file was added to the image, without which SUN RPC calls from userspace did not go beyond the portmapper (NFSv4 is not affected)
• Fixed CreateVolume/CreateSnapshot idempotency: a repeated call no longer overwrites the data of an already created volume - previously this led to the inability to boot VMs from newly cloned disks
• Updating base images, Go 1.26.5 and lib-helm to 1.72.10
• Documentation updated: README, examples, FAQ and CR descriptions
• Internal changes in module assembly and CI, added a set of e2e tests

v0.4.1

• Updating base images, Go 1.26.5 and lib-helm to 1.72.9
• Internal changes in module assembly

v0.4.0

• Fixed generation of access secret to registry (deckhouse-registry): Now it only contains authorization data for the active image source
• Transition to distroless images
• Updating container-base images to v1.1.8, Go 1.26.4 and lib-helm to 1.72.4

v0.3.27

• When forwarding labels from NFSStorageClass to StorageClass, labels with specified ignored prefixes are now excluded
• Updating base images and lib-helm to 1.72.0

v0.3.26

• Labels from NFSStorageClass are now forwarded to the Kubernetes managed StorageClass
• Update base images, Go 1.25.10 and lib-helm 1.71.12

v0.3.25

• Internal changes in module structure and assembly

v0.3.24

• Added mount points in the csi-nfs-scheduler-extender distroless image
• NFS server installation guide for RedOS
• Internal changes in module structure and assembly

v0.3.23

• Update base images, Go 1.25.10 and lib-helm 1.71.11
• Internal changes to the module assembly

v0.3.22

• Corrections to the module structure

v0.3.21

• CI changes: DistroPackagesProxy and env proxy in werf, improvements to CVE scans (role_name, checkout)
• Added user-authz cluster roles in templates

v0.3.20

• Installing packages in NodeGroupConfiguration no longer causes the script to crash on errors

v0.3.19

• Updating base images and lib-helm

v0.3.18

• Fix CVE
• Documentation changes

v0.3.17

• Update base images and golang version
• Updated hooks that work when a module is removed
• Disabled Capacity request from k8s (CSI does not support issuing Capacity)

v0.3.16

• Module-sdk update for CVE fix
• Refactoring manifests
• Fixed an error when placing pods on nodes in the absence of NFSStorageClass

v0.3.15

• Updated base images versions
• Documentation fixes
• Manifest fixes
• Updated CSI driver version to v4.12.1
• CVE fixes

v0.3.14

• Documentation fixes
• Build changes for CSE version

v0.3.13

• Updated base images versions
• CVE fixes
• Updated golang version to 1.24.10

v0.3.12

• Updated Go version to 1.24.9
• Updated lib-helm to deckhouse_lib_helm-1.64.1
• Documentation update

v0.3.11

• CVE fixes

v0.3.10

• Updated Go version to 1.24.8
• Updated lib-helm to deckhouse_lib_helm-1.63.6

v0.3.9

• Fixes for containerd v2 support
• Fixes for better centos-like distros support
• Some module structure changes

v0.3.8

• Added requirements for DVP in docs

v0.3.7

• Removed some legacy code

v0.3.6

• Added release notes
• Hooks switched from python to golang

v0.3.5

• Added containerd v2 support

v0.3.4

• Added additional mountings for containerd v2 support

v0.3.3

• Added information about the need for snapshot-controller for module operation
• Added readonlyRootFilesystem for enhanced module security

v0.3.2

• CVE fixes

v0.3.1

• Service account changed to “csi”
• Added dependency on snapshot-controller
• Internal changes for containerd v2 support
• CVE fixes
• Documentation fixes

v0.3.0

• Added HA mode support in controller
• Fixes for proper volume snapshots operation
• Updated CSI version to current v4.11.0

v0.2.5

• CSI bugfix (missing /tmp mount point was fixed)

v0.2.4

• Technical release, module refactoring

v0.2.3

• Added base64 certificate validation in MC
• Fixes in RPC-with-TLS mechanism
• Module refactoring

v0.1.10

• Multiple fixes and improvements in RBAC, MC work, controllers
• Added ability to specify workload node selector, considering which csi-nfs components and useful user workload will be deployed

v0.1.9

• Fixed healthcheck ports for csi
• Fixed installation and startup of rpcbind