Release Notes

v0.2.30

Release date: 2026-09-14

The module now installs the iSCSI and NVMe userspace itself where a node’s repositories cannot, exports metrics for the controller and the scheduler extender, and no longer hands 5% of every ext4 volume to the superuser.

Highlights

Changes in this release:

• A node whose repositories cannot provide open-iscsi, multipath-tools or nvme-cli is no longer left unable to attach a volume: the module installs them from package images of its own.
• The controller and the scheduler extender export metrics, scraped through the kube-rbac-proxy of their pod; a ServiceMonitor and a PodMonitor ship with the module.
• An ext4 volume no longer keeps 5% of its space for the superuser, and a YadroTatlinUnifiedStorageClass can ask for a share back with an annotation.

New features

This release adds:

• Where a node’s package manager cannot install open-iscsi and multipath-tools, the NodeGroupConfiguration falls back to the module’s own iscsi-tools image: the payload is unpacked under /var/lib/deckhouse/sds and the daemons come up as d8-csi-yadro-tatlin-unified-iscsid.service and d8-csi-yadro-tatlin-unified-multipathd.service. A node that already has open-iscsi of its own is left untouched, because a client of one version does not speak to a daemon of another.
• nvme-cli gets a package image and a fallback of its own, nvme-tools, used only where the module is configured for NVMe-TCP. Its fallback is independent of the iSCSI one: a distribution may provide one set and not the other. Without nvme-cli a node kept no NVMe Qualified Name and the driver reported initiators is empty for every volume it was asked to publish there.
• The controller and the scheduler extender serve metrics behind a kube-rbac-proxy: the component binds on 127.0.0.1 and the proxy publishes it over TLS behind an authorization check. A ServiceMonitor for the controller and a PodMonitor for the extender are part of the module, and the ports are settable through the controllerMetricsPort, controllerMetricsProxyPort, schedulerExtenderMetricsPort and schedulerExtenderMetricsProxyPort module values.
• The storage.deckhouse.io/ext4-reserved-percent annotation on a YadroTatlinUnifiedStorageClass sets the share of a volume kept for the superuser: a whole number from 0 to 50. It applies only to volumes created after the annotation was set, a class with fsType: xfs ignores it, and an invalid value leaves the YadroTatlinUnifiedStorageClass with Ready=False and the reason in its status instead of failing volume creation later. Changing the annotation makes the controller recreate the StorageClass, because the parameters of an existing one are immutable in Kubernetes.

Improvements

This release improves:

• An ext4 volume is now formatted with no superuser reserve at all. Every volume this module created before handed ext4’s default 5% to root, because the formatting step passed no -m; volumes created from now on give that space to the workload.
• The controller and the scheduler extender log through one shared logger in the structured format the rest of the fleet uses.
• The default logLevel is now INFO instead of DEBUG, which is what a cluster that never set it explicitly will get.

Fixes

This release fixes:

• The CSI Pods no longer wait for a YadroTatlinUnifiedStorageConnection to exist before they start. Both Secrets they mount are written by the controller while it reconciles a connection, and the chart required those volumes, so on a fresh install every CSI Pod sat in ContainerCreating with secret not found and the driver was down until somebody declared a connection. The mounts are optional now, and kubelet fills them in once the Secrets appear.

Upgrade notes

Before upgrading, note the following:

• Nothing has to be done by hand. The new packages are installed only on nodes where the distribution packages cannot be, and nodes that already carry their own stack are not touched.
• The ext4 superuser reserve changes for volumes created after the update only. Filesystems that already exist keep the 5% they were formatted with; to keep a reserve on new volumes, annotate the class with storage.deckhouse.io/ext4-reserved-percent=5.
• A cluster that relied on the previous default verbosity should set logLevel: DEBUG in the module configuration explicitly, because the default is now INFO.

v0.2.29

• Fix: successful mount is no longer considered an error — the image now includes /etc/mtab (a symlink to /proc/self/mounts), whose absence previously caused mount to return exit code 16. The wrap-mount wrapper is now limited to iscsiadm and no longer replaces mount
• Fix: the release image is no longer built from a cache with an outdated changelog.yaml — git-mapping dependencies are tied to the install stage, where the file is copied
• Internal build changes for the module

v0.2.28

• Bugfix: the controller is granted patch on events instead of list - a repeated event write is no longer denied by RBAC
• Bugfix: the VPA is switched from the deprecated Auto update mode to InPlaceOrRecreate
• Optional resources are enabled based on the presence of the CRD in the API, not on the list of enabled modules
• CVE fixes
• Base images updated to v2.1.2, Go to 1.26.6 and lib-helm to 1.72.14

v0.2.27

• YadroTatlinUnifiedStorageClass and YadroTatlinUnifiedStorageConnection publish status.conditions and status.observedGeneration, added Ready column. The status.phase field retains the same set of values, but is now calculated from the Ready condition
• Update base images to v1.3.25, Go 1.26.5 and lib-helm to 1.72.13

v0.2.26

• The snapshot-controller module is no longer a required dependency: VolumeSnapshotClass is created only if the snapshot.storage.k8s.io API is available
• Update base images, Go 1.26.5 and lib-helm to 1.72.12
• Fixed a vulnerability in gRPC (GHSA-hrxh-6v49-42gf)
• Internal changes in module assembly

v0.2.25

• Driver update to vendor version v26.06
• Bugfix: numerous fixes in the operation of the NVMe-over-TCP mode
• Bugfix: secret deckhouse-registry scope limited to active image source
• Fixed vulnerabilities in third-party dependencies
• Internal changes in module assembly

v0.2.24

• Updating container-base images to v1.1.2

v0.2.23

• Fixed mount paths in the scheduler-extender image
• Added instructions for setting up NQN hosts for NVMe-over-TCP to the documentation

v0.2.22

• When forwarding labels from YadroTatlinUnifiedStorageClass to StorageClass, labels with specified ignored prefixes are now excluded
• Updated CSI driver to version yadro/tatlin-unified v26.02

v0.2.21

• Added support for the NVMe-over-TCP protocol in YadroTatlinUnifiedStorageConnection (requires Tatlin Unified Gen2 with firmware 3.2.0 or later and a pre-created access group of type nvme)
• Update base images and lib-helm to 1.72.0

v0.2.20

• Labels from YadroTatlinUnifiedStorageClass are now forwarded to the managed StorageClass Kubernetes
• Update base images, Go 1.25.10 and lib-helm 1.71.12

v0.2.19

• Internal changes in the structure and assembly of the module

v0.2.18

• Update base images, Go 1.25.10 and lib-helm 1.71.11
• Internal changes to the module assembly

v0.2.17

• Changes in CI: DistroPackagesProxy and env proxy in werf, improvements to CVE scans (role_name, checkout)
• Added user-authz cluster roles in templates

v0.2.16

• Installing packages in NodeGroupConfiguration no longer causes the script to crash on errors
• Replacement of yum with bb-dnf, separation of NGC for Debian and Altlinux, unification of naming

v0.2.15

• Added missing mount points in the csi-yadro-tatlin-unified distroless image
• Update base images, Go and lib-helm

v0.2.14

• CVE fixes
• Documentation edits

v0.2.13

• Update base images and golang version
• Updated hooks that work when a module is removed

v0.2.12

• Reworking module manifests
• Update CSI version to 25.12

v0.2.11

• Fix CVE
• Fix manifests

v0.2.10

• Updated base images versions
• Updated Go to 1.24.11
• Updated lib-helm to deckhouse_lib_helm-1.64.10
• Added volumesnapshotclass annotation to StorageClass for compatibility
• Fixed build of CSI
• Updated CSI

v0.2.9

• Updated base images versions

v0.2.8

• Updated Go version to 1.24.9
• Updated lib-helm to deckhouse_lib_helm-1.64.1

v0.2.7

• Updated sources for CVE fix

v0.2.6

• Updated Go version to 1.24.8
• Updated lib-helm to deckhouse_lib_helm-1.63.6

v0.2.5

• Added release notes
• Module refactoring
• Switched to csi service account
• Added support for containerd v2
• Switch to distroless image

v0.2.4

• Added postStop hook for socket file cleanup when stopping csi-node
• Added HA mode support for CSI controller

v0.2.3

• Added nodeSelector parameter to specify nodes with workload

v0.2.0

• CSI update to version 25.04
• Several bug fixes

v0.1.1

• Multiple fixes to comply with style guides
• Migration of hooks to Golang

v0.1.0

• Module rollout after renaming (old one left with deprecated mark)