Release Notes

v0.2.22

Release date: 2026-09-09

The controller metrics announced in the previous release are actually collected now: the kube-rbac-proxy in front of them could not authorise a single scrape.

Highlights

Changes in this release:

• Prometheus collects the controller metrics, which it never once managed to do since they were introduced in the previous release. The kube-rbac-proxy that fronts them had no permission to create the TokenReview and SubjectAccessReview every scrape is authorised with, so it rejected all of them: up == 0 for the csi-s3-controller job and a TargetDown that never cleared.

Fixes

This release fixes:

• The kube-rbac-proxy in front of the controller metrics is bound to the d8:rbac-proxy ClusterRole now, so it can authorise a scrape. Without that binding it failed closed on every scrape, and the only symptom was an unreachable target: not one metric of the module’s controller reached Prometheus — reconcile counts and durations, workqueue depth, client-go latency, all of them — and TargetDown fired for as long as the module was installed.

Upgrade notes

Before upgrading, note the following:

• Nothing has to be done in the module configuration. A TargetDown firing for the csi-s3-controller job clears on its own once the new controller pod is running and the first scrape succeeds.

v0.2.21

Release date: 2026-09-04

The module controller now exports Prometheus metrics, scraped through the kube-rbac-proxy of its own pod, and writes structured logs; a release of the module is described in sections and in both languages.

Highlights

Changes in this release:

• Controller metrics are collected by Prometheus with no configuration: a ServiceMonitor in d8-monitoring scrapes them under the job csi-s3-controller, so reconcile counts and durations, workqueue depth and client-go latency become visible.
• The controller writes structured logs — a component name and key-value fields instead of the [main]-style prefixes — so anything that parses its log lines has to be adjusted.
• A release is described in sections — summary, highlights, new features, improvements, fixes — in English and in Russian, and the console shows the notes in the language of the reader.

New features

This release adds:

• The controller now exports metrics.

Improvements

This release improves:

• The controller logs through the shared logger of the storage modules: every line carries the component it came from and its fields as key-value pairs. settings.logLevel keeps working exactly as before (ERROR, WARN, INFO, DEBUG) — what changed is the shape of a line, not the level.
• Release notes are written per locale in .release-notes/<tag>.yaml and <tag>.ru.yaml with the sections summary, highlights, new_features, improvements, fixes, security, breaking, upgrade_notes, known_issues, docs and dependencies. Both locales reach the cluster; the releases cut before this one keep the previous flat format and render on the same page exactly as before.

Fixes

This release fixes:

• A release tag with no release notes used to publish an empty changelog.yaml, leaving ModuleRelease.spec.changelog blank with a green build. Such a tag now fails the build.

Upgrade notes

Before upgrading, note the following:

• Nothing has to be done in the module configuration.

v0.2.20

• Bugfix: the controller is granted patch on events instead of list - a repeated event write is no longer denied by RBAC
• Base images updated to v2.1.2, Go to 1.26.6 and lib-helm to 1.72.14

v0.2.19

• S3StorageClass publishes status.conditions and status.observedGeneration, added Ready column. The status.phase field retains the same set of values, but is now calculated from the Ready condition
• Update base images to v1.3.25, Go 1.26.5 and lib-helm to 1.72.13

v0.2.18

• Update base images, Go 1.26.5 and lib-helm to 1.72.12
• Fixed vulnerabilities in third-party dependencies
• Internal changes in module assembly and CI, added a set of e2e tests

v0.2.17

• Update base images, Go 1.26.5 and lib-helm to 1.72.9
• Internal changes in module assembly

v0.2.16

• Fixed the formation of the registry access secret (deckhouse-registry): now it only includes authorization data for the active image source
• Updating container-base images to v1.1.8, Go 1.26.4 and lib-helm to 1.72.4

v0.2.15

• When forwarding labels from S3StorageClass to StorageClass, labels with specified ignored prefixes are now excluded
• Update base images and lib-helm to 1.72.0

v0.2.14

• Labels from S3StorageClass are now forwarded to the managed StorageClass Kubernetes
• Update base images, Go 1.25.10 and lib-helm 1.71.12

v0.2.13

• Added dataNodes.nodeSelector parameter to control the placement of DaemonSet csi-node; an empty object is rejected by the validating webhook
• Added controller that synchronizes nodeSelector value with DaemonSet csi-node

v0.2.12

• Internal changes in the structure and assembly of the module

v0.2.11

• Update base images, Go 1.25.10 and lib-helm 1.71.11
• Internal changes to the module assembly

v0.2.10

• Corrections to the module structure

v0.2.9

• Changes in CI: DistroPackagesProxy and env proxy in werf, improvements to CVE scans (role_name, checkout)
• Added user-authz cluster roles in templates

v0.2.8

• Added infrastructure and missing mount points for distroless images
• Update base images, Go and lib-helm (CVE fix)
• Documentation on module configuration parameters

v0.2.7

• Update base images and golang version
• Updated hooks that work when a module is removed
• Disabled Capacity request from k8s (CSI does not support issuing Capacity)
• Update version k8s-csi-s3 to 0.43.3

v0.2.6

• Reworking module manifests

v0.2.5

• Updated base images version to v0.5.46
• Updated Go version to 1.24.11
• Fixed S3StorageClass field names in documentation examples
• Fixed YAML syntax errors in FAQ examples
• Merged controller and webhooks into single deployment
• Added HA mode support for CSI controller

v0.2.4

• Updated base images versions

v0.2.3

• Updated Go version to 1.24.9
• Updated lib-helm to deckhouse_lib_helm-1.64.1

v0.2.2

• Added release notes

v0.2.1

• Added readonlyRootFilesystem for enhanced module security

v0.2.0

• Module refactoring
• Service account changed to “csi”

v0.1.5

• Minor documentation fix

v0.1.4

• Module refactoring without changing functionality for end users
• Added Deckhouse version requirements (>= 1.67)

v0.1.3

• Added support for custom CA certificates
• Updated GeeseFS to version 0.43.0