The module lifecycle stage: General Availability

The module has requirements for installation

v0.4.17

Release date: 2026-09-15

The module logs at INFO by default instead of DEBUG, so an installation that never chose a level stops writing debug output from its CSI components.

Highlights

Changes in this release:

  • logLevel defaults to INFO instead of DEBUG. Where the level was never set in the module configuration, the CSI controller and the node plugin become markedly quieter after the update; setting logLevel: DEBUG brings the previous verbosity back.

Improvements

This release improves:

  • The default of logLevel in the module configuration is now INFO. The setting drives LOG_LEVEL of the CSI controller and of the csi-node plugin, so DEBUG as the default meant that every installation which never touched the setting ran its whole data plane at debug verbosity and paid for it in log volume. A logLevel stated explicitly in the ModuleConfig is honoured exactly as before, whatever it says.

Upgrade notes

Before upgrading, note the following:

  • Nothing has to be done in the module configuration. Where logLevel is not set, the components come up at INFO as their pods roll out with the update; where it is set, the level stays as configured. To keep the previous behaviour, set logLevel: DEBUG explicitly.

v0.4.16

Release date: 2026-09-09

A LocalStorageClass can reserve a share of the filesystem for the superuser, the csi-node deadlock that left single nodes unable to attach a volume is fixed, and a release of the module is described in sections and in both languages.

Highlights

Changes in this release:

  • A LocalStorageClass can ask for a share of the filesystem to be kept for the superuser — the classic ext4 reserve — with the storage.deckhouse.io/ext4-reserved-percent annotation. Volumes keep being formatted with no reserve unless it is asked for.
  • A restart of node-driver-registrar no longer wedges the node plugin. That deadlock left one or two nodes of a cluster without the module’s driver in their CSINode, unable to attach a volume, while their siblings were fine.
  • A release is described in sections — summary, highlights, new features, improvements, fixes — in English and in Russian, and the console shows the notes in the language of the reader.

New features

This release adds:

  • storage.deckhouse.io/ext4-reserved-percent on a LocalStorageClass sets the percentage of the filesystem kept for the superuser: a whole number from 0 to 50, default 0. The value travels through the parameters of the managed StorageClass and the CSI volume context to NodeStageVolume, because a CSI driver never sees the annotations of a StorageClass, and tune2fs applies it there. Only a filesystem that stage call has just created is touched: restaging a volume never rewrites the superblock of a filesystem that already carries data, so a volume keeps the reserve it was created with. The reserve applies to the ext family only — with fsType: xfs the annotation is ignored and the validating webhook says so in a warning — and an invalid value is rejected by that webhook outright, instead of failing every volume of the class at stage time. Changing the annotation makes the controller recreate the StorageClass, because parameters of an existing StorageClass are immutable in Kubernetes; existing volumes and PVCs are not affected.

Improvements

This release improves:

  • Release notes are written per locale in .release-notes/<tag>.yaml and <tag>.ru.yaml with the sections summary, highlights, new_features, improvements, fixes, security, breaking, upgrade_notes, known_issues, docs and dependencies. Both locales reach the cluster; the releases cut before this one keep the previous flat format and render on the same page exactly as before.

Fixes

This release fixes:

  • A restart of node-driver-registrar no longer takes the CSI driver with it. The csi-node liveness probe watched a port the registrar serves but was attached to the driver container, and the two deadlocked: the registrar exits by design when registration fails, its port goes with it, the probe kills the driver, the CSI socket disappears, and the restarted registrar can no longer reach it. A node came up with the node plugin wedged — a dozen restarts and no driver in its CSINode, so no volume could be attached there — while other nodes of the same cluster were fine. The probe now sits on the container that serves it.
  • A release tag with no release notes used to publish an empty changelog.yaml, leaving ModuleRelease.spec.changelog blank with a green build. Such a tag now fails the build.

Upgrade notes

Before upgrading, note the following:

  • Nothing has to be done in the module configuration. A node whose csi-node pod was stuck in the registration deadlock recovers as the DaemonSet rolls out the fixed pod — no pod has to be deleted by hand.

Docs

Documentation changes:

  • A FAQ entry describes the share of a volume kept for the superuser: the annotation, the range of values, that the reserve applies only to volumes created afterwards, and that it is ignored for fsType: xfs.

v0.4.15

  • Fix: the release image is no longer built from cache with an outdated changelog.yaml — git-mapping dependencies are bound to the install stage, where the file is copied
  • Update base images to v2.1.4 and lib-helm to 1.72.14
  • Internal build changes for the module

v0.4.14

  • Bugfix: the controller is granted patch on events instead of list - a repeated event write is no longer denied by RBAC
  • Optional resources are enabled based on the presence of the CRD in the API, not on the list of enabled modules - the checks are routed through helm_lib_api_version_exists
  • CVE fixes
  • Internal build changes: CI updated, crds, docs and openapi are shipped in the release image

v0.4.13

  • Correction: LVMLogicalVolume and LVMLogicalVolumeSnapshot remaining after removing a PersistentVolume from a StorageClass with reclaimPolicy Retain no longer remain forever - a collector has been added that removes the module finalizer from resources that have already been requested to be deleted and that are not referenced. Previously, the space in the volume group remained occupied, the LVMLogicalVolume delete command did not complete, and the finalizer had to be removed manually
  • Added metrics for logical volumes and volumes that have outlived their PersistentVolume, five alerting rules and an “SDS Local Volume” dashboard; describes the procedure for manually freeing up space when reclaimPolicy Retain
  • LocalStorageClass publishes status.conditions and status.observedGeneration
  • Correction: condition message is truncated to schema-allowed length
  • Updating base images to v1.3.25 and lib-helm to 1.72.13

v0.4.12

  • The snapshot-controller module is no longer a required dependency: VolumeSnapshotClass is created only if the snapshot.storage.k8s.io API is available
  • Added controller and CSI driver metrics (previously the module did not export anything), logging transferred to common Deckhouse libraries
  • Correction: the volume size during normal creation is aligned to the LVM extent boundary, the volume capacity and restoreSize of the snapshot are reported according to the actual size of the LV - previously a request for 35Mi gave an LV of 36Mi, described as 35Mi
  • Correction: restoring a snapshot or cloning to a StorageClass of type Thick is now rejected - previously the result was Bound PVC without data
  • Correction: free space check for Thick is done by aligned size, error of selecting node with maximum free space is no longer ignored
  • Updating base images and lib-helm to 1.72.12
  • Fixed vulnerability in gRPC (GHSA-hrxh-6v49-42gf)
  • Internal changes in module assembly

v0.4.11

  • Updating base images, Go 1.26.5 and lib-helm to 1.72.10
  • Internal changes in module assembly

v0.4.10

  • Added the ability to select LVMVolumeGroup by labels (labelSelector) in LocalStorageClass
  • Internal changes in module assembly

v0.4.9

  • Fixed generation of access secret to registry (deckhouse-registry): Now it only contains authorization data for the active image source
  • Updating container-base images to v1.1.8, Go 1.26.4 and lib-helm to 1.72.4

v0.4.8

  • Updating container-base images to v1.1.2

v0.4.7

  • When forwarding labels from LocalStorageClass to StorageClass, labels with specified ignored prefixes are now excluded
  • Updating base images and lib-helm to 1.72.0

v0.4.6

  • Labels from LocalStorageClass are now forwarded to the Kubernetes managed StorageClass
  • Update base images, Go 1.25.10 and lib-helm 1.71.12

v0.4.5

  • Internal changes in module structure and assembly

v0.4.4

  • Update base images, Go 1.25.10 and lib-helm 1.71.11
  • Internal changes to the module assembly

v0.4.3

  • Corrections to the module structure

v0.4.2

  • CI changes: DistroPackagesProxy and env proxy in werf, improvements to CVE scans (role_name, checkout)
  • Added user-authz cluster roles in templates

v0.4.1

  • Updating base images and lib-helm

v0.4.0

  • CVE fixes
  • Transition to a common scheduler for SDS
  • Replacing a fixed resize delta with automatic determination of the LVM partition size delta

v0.3.19

  • Added a hook for clearing resources when the module is turned off
  • Removed the enableThinProvisioning setting, we assume that thin provisioning is always enabled
  • Module-sdk update for CVE fix, golang update

v0.3.18

  • Module-sdk update for CVE fix
  • Removed the enableThinProvisioning setting, we assume that thin provisioning is always enabled

v0.3.17

  • Fix controller panic when processing LVG without Node in status
  • Reworking manifests, combining controller and webhook into one Pod

v0.3.16

  • Documentation fixes
  • Fixes in scheduler, corrected behavior when working with other provisioners
  • Bug fixes in controller

v0.3.15

  • Fix HA-mode, now it works correctly
  • Removed scheduler functionality, remaining for compatibility with old Deckhouse versions

v0.3.14

  • Updated base images versions
  • CVE fix
  • Updated Go to 1.24.10

v0.3.13

  • Updated Go version to 1.24.9
  • Updated lib-helm to deckhouse_lib_helm-1.64.1
  • Documenation updates
  • Module refactoring

v0.3.12

  • Updated Go version to 1.24.8
  • Updated lib-helm to deckhouse_lib_helm-1.63.6

v0.3.11

  • Added release notes
  • Hooks switched from python to golang

v0.3.10

  • Added information about the need for snapshot-controller for module operation
  • Added readonlyRootFilesystem for enhanced module security

v0.3.9

  • CVE fixes

v0.3.8

  • CVE fixes
  • Internal changes for containerd v2 support
  • Added dependency on snapshot-controller

v0.3.7

  • Added NodeGetVolumeStats method (for kubelet_volume_stats_* metrics support)

v0.3.6

  • Documentation fixes

v0.3.5

  • Several fixes for proper VolumeSnapshots support

v0.3.4

  • Completely fixed the issue with enabled csi snapshotter in CE version

v0.3.3

  • Fixed the issue with enabled csi snapshotter in CE version
  • Enabled HA mode in CSI controller

v0.3.2

  • Technical release, module refactoring

v0.3.1

  • Documentation fixes
  • Module refactoring

v0.2.3

  • Technical release. Removed “Preview” status from documentation

v0.2.1

  • Fixed issue where freed PVC could be considered as used
  • Reduced module size, excluded build images

v0.2.0

  • Updated golang API libraries for sds-node-configurator v0.4.0 support
  • Multiple fixes in controllers and documentation
  • Added XFS filesystem support

v0.1.2

  • Removed isDefault field (use standard k8s SC annotation)
  • Added support for contiguous volumes
  • Added antiaffinity rules for controller HA mode
  • Added AllocationLimit support
  • Added health and readiness checks in controller

v0.1.1

  • Added documentation description of sds-local-volume pod management process

v0.1.0

  • Fix max volumes per node and R/W map
  • Add LocalStorageClass validation webhook
  • Add logs and upgrading node scoring
  • Add module documentation
  • Add cache for extender-scheduler
  • Add previous channel release version check
  • Fix KubeSchedulerConfiguration API version