Release Notes

v0.2.34

Release date: 2026-10-29

The module hides Tatlin devices from sds-node-configurator, prepares nodes labelled after their bashible run, takes down multipath maps left without paths, and stages volumes reliably on ALT Linux, RED OS, Debian and Ubuntu nodes.

Highlights

Changes in this release:

• The module keeps a BlockDeviceFilter that hides every Tatlin device from sds-node-configurator: the NVMe-TCP namespaces of other nodes and of other clusters in a shared access group are no longer published as free BlockDevices on which an LVMVolumeGroup could be built.
• A node labelled for the CSI node plugin after its bashible run is now prepared and gets the node plugin; previously it stayed without open-iscsi, multipath and the node plugin.
• csi-node takes down Tatlin multipath maps left without paths when it starts, and removes the WWIDs of detached volumes from /etc/multipath/wwids.

New features

This release adds:

• On clusters with sds-node-configurator, the controller keeps the BlockDeviceFilter csi-yadro-tatlin-unified-hide-tatlin with the selector status.blockdevice.storage.deckhouse.io/model NotIn [TATLIN-UNIFIED], which hides every block device of model TATLIN.UNIFIED from sds-node-configurator, whatever the protocol. Every host of an nvme access group sees every namespace of the group, including the volumes of other nodes and, if the group is shared, of other clusters. The filter is created as soon as the BlockDeviceFilter resource exists in the cluster, and a changed selector is put back within a minute.

Improvements

This release improves:

• Before csi-node serves requests, it takes down the Tatlin multipath maps that have no active path, no holder and no mount, and removes from /etc/multipath/wwids the Tatlin WWIDs that have no map or path left. After a successful iSCSI or FC unstage the volume’s WWID is removed from the file as well. Previously the file grew by a line for every volume ever attached, and a map left behind by an interrupted unstage or by a LUN the array unmapped stayed until a reboot.
• When the node’s kernel has no nvme-tcp module, the NodeGroupConfiguration logs an error that names the missing module and the package that carries it (linux-modules-extra-$(uname -r) on Ubuntu). Previously this went unnoticed, and every NVMe-TCP stage on the node failed later with NVMe discovery failed.

Fixes

This release fixes:

• A node labelled for the CSI node plugin after its bashible had already run the module’s step is now prepared. The hook that computes dataNodesChecksum had not run since the move to Go hooks, so labelling a node did not re-run the step, and the node was left without open-iscsi, multipath, the ready label and the CSI node plugin.
• On a node without its own multipath-tools, the module’s package now puts multipath and multipathd on the host’s PATH as well as iscsiadm. The node plugin runs them on the host, took the daemon for stopped and staged every iSCSI volume on a single device without a multipath map.
• NodeUnstageVolume on ALT Linux disconnects the volume. It looked for the device by the name of the devtmpfs mount, which ALT Linux calls udevfs, found none and reported success with the paths and the multipath map still in place.
• The NodeGroupConfiguration no longer sets max_sectors_kb 1024 for TATLIN devices in /etc/multipath/conf.d/tatlin.conf; the kernel takes the transfer limits the array reports. On the 6.12 kernels of ALT Linux and RED OS, writing the limit while a volume was staged or torn down could deadlock the device queue: NodeUnstageVolume never returned and the PV stayed Released. The udev rule that sets the 120-second device timeout is now a single line and applies only to devices of vendor YADRO and model TATLIN; udev used to ignore its first line and set the timeout on any device of model TATLIN.
• NVMe-TCP discovery and connect work on nodes without /sbin/nvme, where nvme comes from the module’s nvme-tools package in /usr/local/sbin: the NVMe connector now runs nvme by name from PATH. Every stage on such a node failed with NVMe discovery failed on every export port and exit status 127.
• An NVMe-TCP stage recovers when the node’s NVMe host was registered on the array before /etc/nvme/hostnqn existed. Discovery subsystem entries in the discovery log are now ignored, so the stage registers the host again with its NQN instead of failing on every retry.
• The first YadroTatlinUnifiedStorageConnection of a new installation no longer makes the controller panic while it creates the credentials Secret.

Security updates

Security updates in this release:

• The CSI driver (csi-tatlin-u) and the hooks (go-hooks) are rebuilt with golang.org/x/net v0.62.0, closing CVE-2026-78661 and CVE-2026-97045.

Upgrade notes

Before upgrading, note the following:

• Nothing has to be done by hand. On the next bashible run the NodeGroupConfiguration rewrites /etc/multipath/conf.d/tatlin.conf without max_sectors_kb and replaces the TATLIN udev rule. On clusters with sds-node-configurator, its agent deletes the BlockDevices it has published for Tatlin devices once the filter appears.
• If an LVMVolumeGroup was built on a Tatlin LUN or namespace, its BlockDevices are deleted as well, and the LVMVolumeGroup reports that they no longer match its blockDeviceSelector.

v0.2.33

Release date: 2026-10-26

The node plugin no longer brings a detached iSCSI LUN back or leaves multipath maps without paths behind, connects a volume over all of its paths after Tatlin drops the node’s sessions, and registers the node on a newly added array without a restart of csi-node.

Highlights

Changes in this release:

• Detaching an iSCSI volume no longer brings its LUN back on the node: the node plugin scans only the LUN it stages instead of every LUN of every iSCSI session, and a multipath map whose paths are all gone is removed on unstage instead of staying behind with queued I/O.
• An iSCSI volume staged right after Tatlin dropped the node’s sessions is connected over all of its paths: refused logins are retried for up to 30 seconds, and sessions that iscsid is recovering are waited for instead of being logged out.
• A YadroTatlinUnifiedStorageConnection created after csi-node started can be used on the node without restarting the pod: the node is registered on the new array as soon as the driver reads the changed configuration.

New features

This release adds:

• On DKP 1.79 and later, where the Pod Security Standards in system namespaces deny instead of warn, the module ships a SecurityPolicyException for the CSI controller and CSI node pods. The controller’s exception allows hostNetwork, which the driver needs to reach the Tatlin management API; the node’s allows hostNetwork, privileged mode, privilege escalation, running as root and the hostPath volumes the node plugin mounts. The objects are created only when the admission-policy-engine CRDs are present, so earlier DKP versions are unaffected.

Improvements

This release improves:

• The TATLIN device section that the NodeGroupConfiguration writes to /etc/multipath/conf.d/tatlin.conf now sets flush_on_last_del yes and deferred_remove yes: multipathd removes a TATLIN map as soon as its last path is deleted, and a flush of a map that a process still holds open is completed when the map is closed instead of failing.

Fixes

This release fixes:

• The node plugin no longer runs iscsiadm -m node --rescan, which scans every LUN of every iSCSI session, in NodeStageVolume, NodeUnstageVolume, NodePublishVolume and NodeUnpublishVolume. Run before the controller unmapped a volume, it recreated the volume’s devices, and once the array unmapped it they stayed as a multipath map with no path and queue_if_no_path. The only scan left is the one before a volume is connected, and it covers only the staged LUN on every logged-in session, including sessions whose last device is already gone. The iSCSI node records the driver logs in through get node.session.scan = manual, so a login no longer makes the kernel scan every LUN of the new session.
• NodeUnstageVolume takes down a multipath map that has no active path: it disables queueing, deletes the map’s paths and removes the map deferred. Previously it retried multipath -f, which fails for as long as a process blocked on the queued I/O holds the map open, and the volume could not leave the node. A map that still has an active path is flushed as before.
• NodeUnstageVolume after a restart of csi-node no longer reports success without disconnecting the volume when the device name kept in the pod is gone. For iSCSI and FC it asks the array for the volume’s WWID and disconnects by it; for NVMe-TCP it finds the namespaces by the NGUID the volume’s access group lists on the array and takes down only the multipath maps (mpath-*) over them, leaving other device-mapper devices such as LVM or dm-crypt alone. Only a 404 from the array means the volume is gone; any other error of the array fails the unstage with Unavailable, and kubelet retries it.
• The node plugin no longer logs out of all iSCSI sessions to the array when its counter of staged volumes reaches zero. The counter was seeded from the number of LUNs mapped to the node rather than the volumes staged on it, so the logout could cut the sessions under volumes still mounted on the node.
• Before an iSCSI volume is connected, a portal without a session is logged in to and, while the array refuses the login, retried every 3 seconds for up to 30 seconds; a session that iscsid is recovering is waited for instead of being logged out and in again. A portal is held off for 5 minutes only when its login timed out or was still refused at the end of the window, and later stages skip it only while the target has another session. Previously every refused portal was held off for 5 minutes and the volume stayed connected over whichever sessions happened to be up.
• Every iSCSI session to a target is now recognised. The parser of iscsiadm -m session -P 2 saw only one session per target, so the node plugin took the others for missing and logged them out and in again, although they carried other volumes’ paths; when the array refused the login, the session was lost.
• When multipathd is running, the node plugin adds the LUN’s WWID to /etc/multipath/wwids before the iSCSI scan and the FC connect. With find_multipaths yes, paths that appeared before the WWID was known stayed marked as not belonging to a multipath map: sds-node-configurator could publish such a path as a BlockDevice, and LVM could activate volumes on it directly.
• An FC volume gets a multipath map over all of its paths when other volumes are staged at the same time. The node plugin scans each missing path of the LUN by its channel, target and LUN instead of rescanning the whole host, waits up to 5 seconds for the paths to get a block device, and counts a device only when its WWN matches the LUN’s, rescanning once a device left at that address by an earlier volume.
• NodePublishVolume for a filesystem volume refuses with Unavailable a device that has no usable path, that is, a multipath map without an active path or an NVMe namespace without a live controller in a usable ANA state. It used to run blkid, mkfs or mount on such a device, which hung in the kernel and made every later call for the volume end with Aborted. Raw block volumes are published as before.
• The node is registered on an array whose YadroTatlinUnifiedStorageConnection was created after csi-node started. Previously the array had no host for the node until csi-node was restarted: for iSCSI and FC ControllerPublishVolume failed with can't find host by nodeID, and NVMe-TCP stages failed after an empty discovery. NVMe-TCP discovery and connect errors now fail the stage with their real reason instead of discovery complete but devices not found.
• NVMe-TCP volumes are staged on nodes whose nvme is in /usr/local/sbin or /usr/local/bin, where the module’s nvme-tools package and builds from source put it. The node plugin used to look for it only in /bin, /sbin, /usr/bin and /usr/sbin, and every stage failed.
• NodeGetVolumeStats no longer reports every NVMe-TCP volume as abnormal with host is not attached to volume: the node’s host is looked up under its NVMe-TCP name, and the volume counts as attached when one of its access groups lists it.
• csi-node starts after a hard power-off of the node: the stale csi.sock left by the previous instance is removed on start. Every new pod used to fail with bind: address already in use until the file was removed by hand.
• The logLevel setting of the module now reaches the CSI driver: its CSI_LOG_LEVEL follows logLevel instead of being fixed at info, and the --v argument of the controller and node containers follows it as in the other CSI modules instead of being fixed at 5.

Security updates

Security updates in this release:

• The CSI driver (csi-tatlin-u), the module’s controller, webhooks, scheduler extender and hooks (go-hooks) are rebuilt against patched Go dependencies, closing CVE-2026-78669, CVE-2026-78659, CVE-2026-78660, CVE-2026-78663, CVE-2026-97032, CVE-2026-56851 and, in go-hooks, CVE-2026-63209. go-hooks no longer contains docker/distribution, which carried CVE-2026-85747 without a fixed release.

Upgrade notes

Before upgrading, note the following:

• Nothing has to be done by hand. On the next bashible run the NodeGroupConfiguration updates /etc/multipath/conf.d/tatlin.conf and reloads or restarts multipathd on the nodes the module serves. Sessions the driver logs in to after the update use node.session.scan = manual.

v0.2.32

Release date: 2026-10-01

The iSCSI, multipath and NVMe tools on a node now always come from the module’s own packages instead of the distribution’s repositories, and the module grants access to its resources through the RBACv2 roles of DKP 1.78.

Highlights

Changes in this release:

• The NodeGroupConfiguration no longer asks the node’s package manager for open-iscsi, multipath-tools or nvme-cli: a node without a route to its repositories no longer waits for them on every bashible run, and the tools a node lacks come from the module’s iscsi-tools and nvme-tools packages.
• On DKP 1.78 and later the module ships the d8:system-capability:csi-yadro-tatlin-unified:view and d8:system-capability:csi-yadro-tatlin-unified:edit roles for YadroTatlinUnifiedStorageClass and YadroTatlinUnifiedStorageConnection.

New features

This release adds:

• The module ships RBACv2 roles for its cluster-scoped resources YadroTatlinUnifiedStorageClass and YadroTatlinUnifiedStorageConnection: view grants get, list and watch, edit grants create, update, patch, delete and deletecollection. On DKP 1.78 and later they are the capabilities d8:system-capability:csi-yadro-tatlin-unified:view and d8:system-capability:csi-yadro-tatlin-unified:edit with rbac.deckhouse.io/scope: system; on earlier DKP versions the same rules come as d8:manage:permission:module:csi-yadro-tatlin-unified:view and d8:manage:permission:module:csi-yadro-tatlin-unified:edit. view is aggregated into the storage viewer role and edit into the storage manager role.

Improvements

This release improves:

• The NodeGroupConfiguration installs the iscsi-tools package on every node the module serves, and nvme-tools on every such node where NVMe-TCP is configured, instead of trying the distribution’s open-iscsi, multipath-tools and nvme-cli first. iscsi-tools now decides for each pair separately: an iscsiadm/iscsid or multipath/multipathd pair the host already has stays the host’s and only its distribution unit is enabled, a missing pair lands under /var/lib/deckhouse/sds/csi-yadro-tatlin-unified with a d8-csi-yadro-tatlin-unified-* unit of its own. A host with open-iscsi but no multipath-tools now gets the module’s multipathd; previously the module’s package stepped aside as soon as the host had any iscsiadm. nvme-tools still lands nvme only on a host that has none.
• spec.controlPlane.nodeSelector and spec.dataPlane.nodeSelector of YadroTatlinUnifiedStorageConnection are now atomic for server-side apply: a selector is replaced as a whole instead of being merged field by field between two appliers. Every matchExpressions item now requires key and operator; an item without them selected nothing before.

Fixes

This release fixes:

• A node whose own tools changed after the module’s package was installed is set up again on the next bashible run. The package’s install step ran only once per module version, so a tool the host later lost stayed missing until the next release, and a distribution package installed later ran its daemon next to the module’s. The NodeGroupConfiguration now compares, for iscsiadm, multipathd and nvme, whether the host and the package provide it, and reinstalls the package when the two no longer agree.
• Files that an earlier version of iscsi-tools or nvme-tools put outside its own directory, such as the /usr/local/sbin/iscsiadm and /usr/local/sbin/nvme wrappers and the multipath links and plugins, are no longer mistaken for the host’s own after an update and are removed when the package is uninstalled.

Upgrade notes

Before upgrading, note the following:

• Nothing has to be done by hand. Nodes that already run the distribution’s iscsid, multipathd or nvme keep them; a node that relies on the module’s packages keeps them as well. A node that needs the distribution’s tools from now on has to have them installed by an administrator: on the next bashible run the module notices them and steps aside for that pair.

Docs

Documentation changes:

• The FAQ entry on open-iscsi, multipath-tools and nvme-cli now describes where each tool on a node comes from, which files the module’s packages put on the host and how to check which pair a node took from where.
• The reference for YadroTatlinUnifiedStorageClass now describes spec, and the reference for YadroTatlinUnifiedStorageConnection describes the matchExpressions items of both node selectors, in English and Russian.

v0.2.31

Release date: 2026-09-24

Security update: the CSI driver and the module’s hooks are rebuilt against patched grpc and x/crypto.

Highlights

Changes in this release:

• google.golang.org/grpc is raised from v1.82.1 to v1.83.2 in the CSI driver (csi-tatlin-u), closing CVE-2026-84303, CVE-2026-84304 and CVE-2026-84445.

Security updates

Security updates in this release:

• google.golang.org/grpc is raised from v1.82.1 to v1.83.2 in the CSI driver (csi-tatlin-u), closing CVE-2026-84303, CVE-2026-84304 and CVE-2026-84445.
• golang.org/x/crypto is raised from v0.53.0 to v0.57.0 in the module’s hooks (go-hooks), closing CVE-2026-56854 (authentication bypass by source address in x/crypto/ssh), CVE-2026-56855 and CVE-2026-78662.

v0.2.30

Release date: 2026-09-14

The module now installs the iSCSI and NVMe userspace itself where a node’s repositories cannot, exports metrics for the controller and the scheduler extender, and no longer hands 5% of every ext4 volume to the superuser.

Highlights

Changes in this release:

• A node whose repositories cannot provide open-iscsi, multipath-tools or nvme-cli is no longer left unable to attach a volume: the module installs them from package images of its own.
• The controller and the scheduler extender export metrics, scraped through the kube-rbac-proxy of their pod; a ServiceMonitor and a PodMonitor ship with the module.
• An ext4 volume no longer keeps 5% of its space for the superuser, and a YadroTatlinUnifiedStorageClass can ask for a share back with an annotation.

New features

This release adds:

• Where a node’s package manager cannot install open-iscsi and multipath-tools, the NodeGroupConfiguration falls back to the module’s own iscsi-tools image: the payload is unpacked under /var/lib/deckhouse/sds and the daemons come up as d8-csi-yadro-tatlin-unified-iscsid.service and d8-csi-yadro-tatlin-unified-multipathd.service. A node that already has open-iscsi of its own is left untouched, because a client of one version does not speak to a daemon of another.
• nvme-cli gets a package image and a fallback of its own, nvme-tools, used only where the module is configured for NVMe-TCP. Its fallback is independent of the iSCSI one: a distribution may provide one set and not the other. Without nvme-cli a node kept no NVMe Qualified Name and the driver reported initiators is empty for every volume it was asked to publish there.
• The controller and the scheduler extender serve metrics behind a kube-rbac-proxy: the component binds on 127.0.0.1 and the proxy publishes it over TLS behind an authorization check. A ServiceMonitor for the controller and a PodMonitor for the extender are part of the module, and the ports are settable through the controllerMetricsPort, controllerMetricsProxyPort, schedulerExtenderMetricsPort and schedulerExtenderMetricsProxyPort module values.
• The storage.deckhouse.io/ext4-reserved-percent annotation on a YadroTatlinUnifiedStorageClass sets the share of a volume kept for the superuser: a whole number from 0 to 50. It applies only to volumes created after the annotation was set, a class with fsType: xfs ignores it, and an invalid value leaves the YadroTatlinUnifiedStorageClass with Ready=False and the reason in its status instead of failing volume creation later. Changing the annotation makes the controller recreate the StorageClass, because the parameters of an existing one are immutable in Kubernetes.

Improvements

This release improves:

• An ext4 volume is now formatted with no superuser reserve at all. Every volume this module created before handed ext4’s default 5% to root, because the formatting step passed no -m; volumes created from now on give that space to the workload.
• The controller and the scheduler extender log through one shared logger in the structured format the rest of the fleet uses.
• The default logLevel is now INFO instead of DEBUG, which is what a cluster that never set it explicitly will get.

Fixes

This release fixes:

• The CSI Pods no longer wait for a YadroTatlinUnifiedStorageConnection to exist before they start. Both Secrets they mount are written by the controller while it reconciles a connection, and the chart required those volumes, so on a fresh install every CSI Pod sat in ContainerCreating with secret not found and the driver was down until somebody declared a connection. The mounts are optional now, and kubelet fills them in once the Secrets appear.

Upgrade notes

Before upgrading, note the following:

• Nothing has to be done by hand. The new packages are installed only on nodes where the distribution packages cannot be, and nodes that already carry their own stack are not touched.
• The ext4 superuser reserve changes for volumes created after the update only. Filesystems that already exist keep the 5% they were formatted with; to keep a reserve on new volumes, annotate the class with storage.deckhouse.io/ext4-reserved-percent=5.
• A cluster that relied on the previous default verbosity should set logLevel: DEBUG in the module configuration explicitly, because the default is now INFO.

v0.2.29

• Fix: successful mount is no longer considered an error — the image now includes /etc/mtab (a symlink to /proc/self/mounts), whose absence previously caused mount to return exit code 16. The wrap-mount wrapper is now limited to iscsiadm and no longer replaces mount
• Fix: the release image is no longer built from a cache with an outdated changelog.yaml — git-mapping dependencies are tied to the install stage, where the file is copied
• Internal build changes for the module

v0.2.28

• Bugfix: the controller is granted patch on events instead of list - a repeated event write is no longer denied by RBAC
• Bugfix: the VPA is switched from the deprecated Auto update mode to InPlaceOrRecreate
• Optional resources are enabled based on the presence of the CRD in the API, not on the list of enabled modules
• CVE fixes
• Base images updated to v2.1.2, Go to 1.26.6 and lib-helm to 1.72.14

v0.2.27

• YadroTatlinUnifiedStorageClass and YadroTatlinUnifiedStorageConnection publish status.conditions and status.observedGeneration, added Ready column. The status.phase field retains the same set of values, but is now calculated from the Ready condition
• Update base images to v1.3.25, Go 1.26.5 and lib-helm to 1.72.13

v0.2.26

• The snapshot-controller module is no longer a required dependency: VolumeSnapshotClass is created only if the snapshot.storage.k8s.io API is available
• Update base images, Go 1.26.5 and lib-helm to 1.72.12
• Fixed a vulnerability in gRPC (GHSA-hrxh-6v49-42gf)
• Internal changes in module assembly

v0.2.25

• Driver update to vendor version v26.06
• Bugfix: numerous fixes in the operation of the NVMe-over-TCP mode
• Bugfix: secret deckhouse-registry scope limited to active image source
• Fixed vulnerabilities in third-party dependencies
• Internal changes in module assembly

v0.2.24

• Updating container-base images to v1.1.2

v0.2.23

• Fixed mount paths in the scheduler-extender image
• Added instructions for setting up NQN hosts for NVMe-over-TCP to the documentation

v0.2.22

• When forwarding labels from YadroTatlinUnifiedStorageClass to StorageClass, labels with specified ignored prefixes are now excluded
• Updated CSI driver to version yadro/tatlin-unified v26.02

v0.2.21

• Added support for the NVMe-over-TCP protocol in YadroTatlinUnifiedStorageConnection (requires Tatlin Unified Gen2 with firmware 3.2.0 or later and a pre-created access group of type nvme)
• Update base images and lib-helm to 1.72.0

v0.2.20

• Labels from YadroTatlinUnifiedStorageClass are now forwarded to the managed StorageClass Kubernetes
• Update base images, Go 1.25.10 and lib-helm 1.71.12

v0.2.19

• Internal changes in the structure and assembly of the module

v0.2.18

• Update base images, Go 1.25.10 and lib-helm 1.71.11
• Internal changes to the module assembly

v0.2.17

• Changes in CI: DistroPackagesProxy and env proxy in werf, improvements to CVE scans (role_name, checkout)
• Added user-authz cluster roles in templates

v0.2.16

• Installing packages in NodeGroupConfiguration no longer causes the script to crash on errors
• Replacement of yum with bb-dnf, separation of NGC for Debian and Altlinux, unification of naming

v0.2.15

• Added missing mount points in the csi-yadro-tatlin-unified distroless image
• Update base images, Go and lib-helm

v0.2.14

• CVE fixes
• Documentation edits

v0.2.13

• Update base images and golang version
• Updated hooks that work when a module is removed

v0.2.12

• Reworking module manifests
• Update CSI version to 25.12

v0.2.11

• Fix CVE
• Fix manifests

v0.2.10

• Updated base images versions
• Updated Go to 1.24.11
• Updated lib-helm to deckhouse_lib_helm-1.64.10
• Added volumesnapshotclass annotation to StorageClass for compatibility
• Fixed build of CSI
• Updated CSI

v0.2.9

• Updated base images versions

v0.2.8

• Updated Go version to 1.24.9
• Updated lib-helm to deckhouse_lib_helm-1.64.1

v0.2.7

• Updated sources for CVE fix

v0.2.6

• Updated Go version to 1.24.8
• Updated lib-helm to deckhouse_lib_helm-1.63.6

v0.2.5

• Added release notes
• Module refactoring
• Switched to csi service account
• Added support for containerd v2
• Switch to distroless image

v0.2.4

• Added postStop hook for socket file cleanup when stopping csi-node
• Added HA mode support for CSI controller

v0.2.3

• Added nodeSelector parameter to specify nodes with workload

v0.2.0

• CSI update to version 25.04
• Several bug fixes

v0.1.1

• Multiple fixes to comply with style guides
• Migration of hooks to Golang

v0.1.0

• Module rollout after renaming (old one left with deprecated mark)