chore(deps): update helm release rook-ceph to v1.16.2 - autoclosed

[timtor-bot]

This PR contains the following updates:

Package	Update	Change
rook-ceph	minor	v1.14.7 -> v1.16.2

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

rook/rook (rook-ceph)

v1.16.2

Compare Source

Improvements

Rook v1.16.2 is a patch release limited in scope and focusing on feature additions and bug fixes to the Ceph operator.

• core: Omit sensitive values from mon db config logs (#​15270, @​arttor)
• core: Add tolerations to crashcollector pruner cronJob pod (#​15258, @​OdedViner)
• image: Fix s5cmd arch for arm64 builds (#​15276, @​obnoxxx)
• osd: Set bluestore during migration if store type is empty (#​15242, @​sp98)
• csi: Update Kubernetes CSI sidecar images to current versions (#​15275, @​nixpanic)
• csi: Set driver name to same as the csi operator namespace (#​15245 #​15264, @​travisn)
• external: Add rados namespace suffix to external storage class name (#​15243, @​parth-gr)
• core: Update golang.org/x/net to 0.33 (#​15235, @​sp98)

v1.16.1

Compare Source

Improvements

Rook v1.16.1 is a patch release limited in scope and focusing on feature additions and bug fixes to the Ceph operator.

• csi: csi-snapshotter flag typo; upgrade csi-snapshotter (#​15196, @​buroa)
• csi: Update groupsnapshot container arg (#​15037, @​Madhu-1)
• object: Add opsLogSidecar to gateway subsection from zone (#​15199, @​ideepika)
• mgr: Fix label selector when updating mgr active label (#​15209, @​degorenko)

v1.16.0

Compare Source

Upgrade Guide

To upgrade from previous versions of Rook, see the Rook upgrade guide.

Breaking Changes

• Removed support for Ceph Quincy (v17) since it has reached end of life. Reef (v18) and Squid (v19) are the currently supported Ceph versions.
• Rook has removed CSI network "holder" pods. If there are pods named csi-plugin-holder- in the Rook operator namespace, see the detailed documentation to disable them before upgrading to v1.16.
• The minimum K8s version is increased to v1.27.

Features

• Ceph-CSI driver v3.13, including support for volume group snapshots, CephFS support for omap in rados namespaces, and other csi improvements.
• Enable mirroring for CephBlockPoolRadosNamespaces
• Enable periodic monitoring for CephBlockPoolRadosNamespaces mirroring if the statusCheck is enabled on the parent CephBlockPool.
• Allow migration of PVC based OSDs to enable or disable encryption.
• Support multiple instances of object stores to enable scenarios such as RGW instances with only admin-ops enabled.
• ObjectBucketClaim management of s3 bucket policy via the additionalConfig.bucketPolicy field (see #​15138).
• Object stores enable arbitrary command line parameters or ceph configuration settings.
• Enable RGW admin ops logs by enabling the opsLogSidecar in the gateway settings.
• Added support for K8s version v1.32.

v1.15.8

Compare Source

Improvements

Rook v1.15.8 is a patch release limited in scope and focusing on feature additions and bug fixes to the Ceph operator.

• core: Omit sensitive values from mon db config logs (#​15270, @​arttor)
• image: Fix s5cmd arch for arm64 (#​15276, @​obnoxxx)
• mgr: fix label selector when updating mgr active label (#​15209, @​degorenko)
• ci: update golang.org/x/net to 0.33 (#​15235, @​sp98)

v1.15.7

Compare Source

Improvements

Rook v1.15.7 is a patch release limited in scope and focusing on feature additions and bug fixes to the Ceph operator.

• object: Update s5cmd to resolve vulnerabilities (#​15178, @​TomHellier)
• object: COSI user to be created explicitly instead of automated by the operator (#​15144, @​BlaineEXE)
• file: Add support for named MDS metadata pool names without the filesystem prefix (#​15056, @​NotTheEvilOne)
• csi: update to the v3.12.3 Ceph-CSI release (#​15058, @​Madhu-1)
• rbdmirror: Add a timeout for the RBD import cmd that may hang (#​15051, @​parth-gr)
• osd: Fix device class label on the OSD deployment (#​15066, @​parth-gr)
• core: Fix Annotations.Merge to prevent side effects (#​15080, @​OdedViner)
• rgw: Fix shared pools for zone (#​15038, @​arttor)

v1.15.6

Compare Source

Improvements

Rook v1.15.6 is a patch release limited in scope and focusing on feature additions and bug fixes to the Ceph operator.

• osd: Log warning when duplicate node topology values are detected (#​15016, @​solidDoWant)
• core: Configure remaining pods with the revision history limit (#​14976, @​obnoxxx)
• helm: Set service account for toolbox pod (#​15019, @​amrut-asm)
• osd: Import keyring file on activate to ceph auth if not imported yet (#​14826, @​prazumovsky)
• mon: Allow failover of the arbiter mon (#​14981, @​GrantFleming)

v1.15.5

Compare Source

Improvements

Rook v1.15.5 is a patch release limited in scope and focusing on feature additions and bug fixes to the Ceph operator.

• rgw: Add support for pool placements (#​14588 #​14715 #​14884 #​14951, @​arttor)
• osd: Mount /run/udev in the init container for ceph-volume activate (#​14901, @​guits)
• osd: Allow scheduling OSDs on unschedulable nodes (#​14949, @​travisn)
• core: Allow setting resources on the detect version job (#​14941, @​travisn)
• mds: Wait for mds standby upgrade for the same filesystem instead of any filesystem (#​14952, @​travisn)
• csi: Remove version check for k8s and cephcsi (#​14942, @​travisn)
• kms: Key rotation support for vault kms (#​14818, @​iPraveenParihar)
• object: Also use system certs for validating RGW cert (#​14835, @​BlaineEXE)
• core: Cleanup blockpool during uninstall if corresponding annotation is set (#​14895, @​Madhu-1)
• object: set OBC user quota(s) in one SetUserQuota() call (#​14827, @​jhoblitt)

v1.15.4

Compare Source

Improvements

Rook v1.15.4 is a patch release limited in scope and focusing on feature additions and bug fixes to the Ceph operator.

• core: Define empty securityContext for pods to fix CIS 5.7.3 (#​14823, @​prazumovsky)
• core: Fix deletion of the osd-replace-config configmap during OSD migration (#​14862, @​sp98)
• core: Allow removal of exporter pods from a node no longer having ceph daemons (#​14854, @​travisn)
• docs: Add documentation for RBD VolumeGroupSnapshot (#​14845, @​black-dragon74)
• csi: Disable fencing in Rook due to unreliable IPs being fenced (#​14831, @​Madhu-1)
• multus: Do not force delete in validation cleanup (#​14820, @​BlaineEXE)
• mon: Do not remove extra mon in middle of failover (#​14805, @​travisn)
• mds: Fix liveness probe timeout when ceph timeout is reached (#​14798, @​BlaineEXE)

v1.15.3

Compare Source

Improvements

Rook v1.15.3 is a patch release limited in scope and focusing on feature additions and bug fixes to the Ceph operator.

• rgw: Allow CephObjectZone and CephObjectStore creation based on pre-existing pools (#​14801 #​14772, @​jhoblitt)
• helm: Add enforce host network setting (#​14791, @​travisn)
• core: Allow configuration of the revision history limit (#​14775, @​obnoxxx)
• core: Preserve pool application name change (#​14755, @​sp98)
• csi: Update privileges in CSI logrotate sidecar container (#​14782, @​parth-gr)
• docs: Declare cephconfig settings stable in the CephCluster CR (#​14752, @​travisn)
• build: Allow building with golang 1.23 (#​14748, @​obnoxxx)
• csi: Fix the ROOK_CSI_DISABLE_DRIVER flag in the CSI driver reconcile (#​14746, @​parth-gr)
• external: Update MDS caps for the healthchecker/cephfs users (#​14722, @​subhamkrai)
• docs: Update external docs with a better structure (#​14718, @​parth-gr)

v1.15.2

Compare Source

Improvements

Rook v1.15.2 is a patch release limited in scope and focusing on feature additions and bug fixes to the Ceph operator.

• core: Enable annotations on crash collector (#​14731, @​travisn)
• exporter: Configure prio-limit for ceph exporter pod (#​14717, @​arttor)
• docs: Add grafana dashboards files to docs (#​14679, @​galexrt)
• pool: Allow negative step num in crush rule (#​14709, @​travisn)
• csi: Stop deleting csi-operator resources when not enabled (#​14693, @​subhamkrai)
• core: Check for duplicate ceph fs pool names (#​14653, @​sp98)
• csi: Update to CephCSI patch release v3.12.2 (#​14694, @​Madhu-1)
• osd: Discover metadata and wal devices for raw device cleanup (#​14645, @​Papawy)
• network: Allow enforcing host network on all pods (#​14585, @​obnoxxx)
• mon: Remove extra mon from quorum before taking down pod (#​14667, @​travisn)

v1.15.1

Compare Source

Improvements

Rook v1.15.1 is a patch release limited in scope and focusing on feature additions and bug fixes to the Ceph operator.

• csi: Update csi-addons to v0.9.1 (#​14671, @​Madhu-1)
• helm: Reorder volumes in rook-ceph-csi scc for argocd diff to show no changes (#​14642, @​raynay-r)
• rgw: Allow users to add custom volume mounts (#​14616, @​BlaineEXE)
• core: Spread Ceph mons across zones when using mon.zones spec (#​14636, @​BenoitKnecht)
• external: Remove the false bool values from config file (#​14627, @​parth-gr)
• core: Host cleanup jobs to read flags correctly (#​14631, @​sp98)
• multus: Fix default service account handling (#​14629, @​BlaineEXE)
• csi: Use specific CSI operator version tag instead of latest image (#​14618, @​subhamkrai)

v1.15.0

Compare Source

Upgrade Guide

To upgrade from previous versions of Rook, see the Rook upgrade guide.

Breaking Changes

• Minimum version of Kubernetes supported is increased to K8s v1.26.
• During CephBlockPool updates, Rook will now return an error if an invalid device class is specified. Pools with invalid device classes may start failing until the correct device class is specified. For more details, see #​14057.
• Rook has deprecated CSI network "holder" pods. If there are pods named csi-*plugin-holder-* in the Rook operator namespace, see the detailed documentation to disable them. This deprecation process will be required before upgrading to the future Rook v1.16.
• Ceph COSI driver images have been updated. This impacts existing COSI Buckets, BucketClaims, and BucketAccesses. Update existing clusters following the guide here.
• CephObjectStore, CephObjectStoreUser, and OBC endpoint behavior has changed when CephObjectStore spec.hosting configurations are set. Use the new spec.hosting.advertiseEndpoint config to define required behavior as documented.

Features

• Added support for Ceph Squid (v19), in addition to Reef (v18) and Quincy (v17). Quincy support will be removed in Rook v1.16.
• Ceph-CSI driver v3.12, including new options for RBD, log rotation, and updated sidecar images.
• Allow updating the device class of OSDs, if allowDeviceClassUpdate: true is set in the CephCluster CR.
• Allow updating the weight of an OSD, if allowOsdCrushWeightUpdate: true is set in the CephCluster CR.
• Use fully-qualified image names (docker.io/rook/ceph) in operator manifests and helm charts.

Experimental Features

• CephObjectStore support for keystone authentication for S3 and Swift. See the Object store documentation to configure.
• CSI operator: CSI settings are moving to CRs managed by a new operator. Once enabled, Rook will convert the settings previously defined in the operator configmap or env vars into the new CRs managed by the CSI operator. There are two steps to enable:
  • Create csi-operator.yaml
  • Set ROOK_USE_CSI_OPERATOR: true in operator.yaml.

v1.14.12

Compare Source

Improvements

Rook v1.14.12 is a patch release limited in scope and focusing on feature additions and bug fixes to the Ceph operator.

• object: Also use system certs for validating RGW cert (#​14835, @​BlaineEXE)
• osd: mount /run/udev in the init container for ceph-volume activate (#​14901, @​guits)
• core: Define empty securityContext for pods to fix CIS 5.7.3 (#​14823, @​prazumovsky)
• csi: Disable fencing in Rook (#​14831, @​Madhu-1)
• mds: Fix liveness probe timeout (#​14798, @​BlaineEXE)

v1.14.11

Compare Source

Improvements

Rook v1.14.11 is a patch release limited in scope and focusing on feature additions and bug fixes to the Ceph operator.

• core: Enable annotations on crash collector (#​14731, @​travisn)
• helm: Reorder volumes in rook-ceph-csi scc for argocd diff to show no changes (#​14642, @​raynay-r)
• core: Fix Ceph monitor placement when zones are specifically defined in a non-stretch cluster (#​14636, @​BenoitKnecht)
• core: Fix host cleanup jobs to read flags correctly (#​14631, @​sp98)
• multus: Default service account handling for the multus tool (#​14629, @​BlaineEXE)

v1.14.10

Compare Source

Improvements

Rook v1.14.10 is a patch release limited in scope and focusing on feature additions and bug fixes to the Ceph operator.

• core: Configuration option added for metrics bindAddress (#​14598, @​jrcichra)
• core: Annotations and labels configurable on detect version jobs (#​14576, @​travisn)
• docs: Troubleshooting topic for containerd LimitNOFILE issue (#​14500, @​nicofnt)

v1.14.9

Compare Source

Improvements

Rook v1.14.9 is a patch release limited in scope and focusing on feature additions and bug fixes to the Ceph operator.

• manifest: Update the ceph recommended version to v18.2.4 (#​14491, @​travisn)
• mgr: Properly detect if dashboard cert already exists to avoid unnecessary dashboard module restarts (#​14484, @​travisn)
• mgr: Lookup cluster crd on active mgr watch (#​14482, @​arttor)
• csi: Make kube apiserver qps configurable (#​14420, @​YiteGu)
• multus: Reset validation tool debounce time to 30 (#​14451, @​BlaineEXE)
• multus: Add host checking to validation tool (#​14230, @​BlaineEXE)
• pool: Skip updating crush rules for stretch clusters (#​14447, @​travisn)

v1.14.8

Compare Source

Improvements

Rook v1.14.8 is a patch release limited in scope and focusing on feature additions and bug fixes to the Ceph operator.

• osd: Fix activate failure when block device moves (#​14374, @​BlaineEXE)
• csi: Update csi-addons repo link for correctly versioned downloads (#​14408, @​Madhu-1)
• build: Update go-retryablehttp from 0.7.6 to 0.7.7 (#​14391, @​subhamkrai)
• osd: Use old passphrase to kill the LUKS slot during key rotation (#​14367, @​black-dragon74)
• csi: Skip creating networkFence when csi is disabled (#​14294, @​subhamkrai)

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.

[github-actions]

--- kubernetes/rook-ceph Kustomization: flux-system/2-rook-ceph HelmRelease: rook-ceph/rook-ceph

+++ kubernetes/rook-ceph Kustomization: flux-system/2-rook-ceph HelmRelease: rook-ceph/rook-ceph

@@ -11,13 +11,13 @@

   chart:
     spec:
       chart: rook-ceph
       sourceRef:
         kind: HelmRepository
         name: rook-ceph
-      version: v1.14.7
+      version: v1.16.2
   install:
     crds: CreateReplace
   interval: 1h
   maxHistory: 1
   upgrade:
     crds: CreateReplace

[github-actions]

--- HelmRelease: rook-ceph/rook-ceph ConfigMap: rook-ceph/rook-ceph-operator-config

+++ HelmRelease: rook-ceph/rook-ceph ConfigMap: rook-ceph/rook-ceph-operator-config

@@ -17,29 +17,28 @@

   CSI_ENABLE_NFS_SNAPSHOTTER: 'true'
   CSI_ENABLE_RBD_SNAPSHOTTER: 'true'
   CSI_PLUGIN_ENABLE_SELINUX_HOST_MOUNT: 'false'
   CSI_ENABLE_ENCRYPTION: 'false'
   CSI_ENABLE_OMAP_GENERATOR: 'false'
   CSI_ENABLE_HOST_NETWORK: 'true'
-  CSI_DISABLE_HOLDER_PODS: 'true'
   CSI_ENABLE_METADATA: 'false'
   CSI_ENABLE_VOLUME_GROUP_SNAPSHOT: 'true'
   CSI_PLUGIN_PRIORITY_CLASSNAME: system-node-critical
   CSI_PROVISIONER_PRIORITY_CLASSNAME: system-cluster-critical
   CSI_RBD_FSGROUPPOLICY: File
   CSI_CEPHFS_FSGROUPPOLICY: File
   CSI_NFS_FSGROUPPOLICY: File
-  ROOK_CSI_CEPH_IMAGE: quay.io/cephcsi/cephcsi:v3.11.0
-  ROOK_CSI_REGISTRAR_IMAGE: registry.k8s.io/sig-storage/csi-node-driver-registrar:v2.10.1
-  ROOK_CSI_PROVISIONER_IMAGE: registry.k8s.io/sig-storage/csi-provisioner:v4.0.1
-  ROOK_CSI_SNAPSHOTTER_IMAGE: registry.k8s.io/sig-storage/csi-snapshotter:v7.0.2
-  ROOK_CSI_ATTACHER_IMAGE: registry.k8s.io/sig-storage/csi-attacher:v4.5.1
-  ROOK_CSI_RESIZER_IMAGE: registry.k8s.io/sig-storage/csi-resizer:v1.10.1
+  ROOK_CSI_CEPH_IMAGE: quay.io/cephcsi/cephcsi:v3.13.0
+  ROOK_CSI_REGISTRAR_IMAGE: registry.k8s.io/sig-storage/csi-node-driver-registrar:v2.13.0
+  ROOK_CSI_PROVISIONER_IMAGE: registry.k8s.io/sig-storage/csi-provisioner:v5.1.0
+  ROOK_CSI_SNAPSHOTTER_IMAGE: registry.k8s.io/sig-storage/csi-snapshotter:v8.2.0
+  ROOK_CSI_ATTACHER_IMAGE: registry.k8s.io/sig-storage/csi-attacher:v4.8.0
+  ROOK_CSI_RESIZER_IMAGE: registry.k8s.io/sig-storage/csi-resizer:v1.13.1
   ROOK_CSI_IMAGE_PULL_POLICY: IfNotPresent
   CSI_ENABLE_CSIADDONS: 'false'
-  ROOK_CSIADDONS_IMAGE: quay.io/csiaddons/k8s-sidecar:v0.8.0
+  ROOK_CSIADDONS_IMAGE: quay.io/csiaddons/k8s-sidecar:v0.11.0
   CSI_ENABLE_TOPOLOGY: 'false'
   ROOK_CSI_ENABLE_NFS: 'false'
   CSI_FORCE_CEPHFS_KERNEL_CLIENT: 'true'
   CSI_GRPC_TIMEOUT_SECONDS: '150'
   CSI_PROVISIONER_REPLICAS: '2'
   CSI_RBD_PROVISIONER_RESOURCE: |
--- HelmRelease: rook-ceph/rook-ceph ClusterRole: rook-ceph/rook-ceph-system

+++ HelmRelease: rook-ceph/rook-ceph ClusterRole: rook-ceph/rook-ceph-system

@@ -39,7 +39,51 @@

 - apiGroups:
   - apiextensions.k8s.io
   resources:
   - customresourcedefinitions
   verbs:
   - get
+- apiGroups:
+  - csi.ceph.io
+  resources:
+  - cephconnections
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - update
+  - watch
+- apiGroups:
+  - csi.ceph.io
+  resources:
+  - clientprofiles
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - update
+  - watch
+- apiGroups:
+  - csi.ceph.io
+  resources:
+  - operatorconfigs
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - update
+  - watch
+- apiGroups:
+  - csi.ceph.io
+  resources:
+  - drivers
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - update
+  - watch
 
--- HelmRelease: rook-ceph/rook-ceph ClusterRole: rook-ceph/cephfs-csi-nodeplugin

+++ HelmRelease: rook-ceph/rook-ceph ClusterRole: rook-ceph/cephfs-csi-nodeplugin

@@ -7,7 +7,31 @@

 - apiGroups:
   - ''
   resources:
   - nodes
   verbs:
   - get
+- apiGroups:
+  - ''
+  resources:
+  - secrets
+  verbs:
+  - get
+- apiGroups:
+  - ''
+  resources:
+  - configmaps
+  verbs:
+  - get
+- apiGroups:
+  - ''
+  resources:
+  - serviceaccounts
+  verbs:
+  - get
+- apiGroups:
+  - ''
+  resources:
+  - serviceaccounts/token
+  verbs:
+  - create
 
--- HelmRelease: rook-ceph/rook-ceph ClusterRole: rook-ceph/cephfs-external-provisioner-runner

+++ HelmRelease: rook-ceph/rook-ceph ClusterRole: rook-ceph/cephfs-external-provisioner-runner

@@ -11,13 +11,27 @@

   verbs:
   - get
   - list
 - apiGroups:
   - ''
   resources:
+  - configmaps
+  verbs:
+  - get
+- apiGroups:
+  - ''
+  resources:
   - nodes
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - storage.k8s.io
+  resources:
+  - csinodes
   verbs:
   - get
   - list
   - watch
 - apiGroups:
   - ''
@@ -85,15 +99,12 @@

   resources:
   - volumesnapshots
   verbs:
   - get
   - list
   - watch
-  - update
-  - patch
-  - create
 - apiGroups:
   - snapshot.storage.k8s.io
   resources:
   - volumesnapshotclasses
   verbs:
   - get
@@ -106,13 +117,12 @@

   verbs:
   - get
   - list
   - watch
   - patch
   - update
-  - create
 - apiGroups:
   - snapshot.storage.k8s.io
   resources:
   - volumesnapshotcontents/status
   verbs:
   - update
@@ -139,7 +149,19 @@

   - groupsnapshot.storage.k8s.io
   resources:
   - volumegroupsnapshotcontents/status
   verbs:
   - update
   - patch
+- apiGroups:
+  - ''
+  resources:
+  - serviceaccounts
+  verbs:
+  - get
+- apiGroups:
+  - ''
+  resources:
+  - serviceaccounts/token
+  verbs:
+  - create
 
--- HelmRelease: rook-ceph/rook-ceph ClusterRole: rook-ceph/rbd-external-provisioner-runner

+++ HelmRelease: rook-ceph/rook-ceph ClusterRole: rook-ceph/rbd-external-provisioner-runner

@@ -93,15 +93,12 @@

   resources:
   - volumesnapshots
   verbs:
   - get
   - list
   - watch
-  - update
-  - patch
-  - create
 - apiGroups:
   - snapshot.storage.k8s.io
   resources:
   - volumesnapshotclasses
   verbs:
   - get
@@ -114,13 +111,12 @@

   verbs:
   - get
   - list
   - watch
   - patch
   - update
-  - create
 - apiGroups:
   - snapshot.storage.k8s.io
   resources:
   - volumesnapshotcontents/status
   verbs:
   - update
@@ -173,15 +169,7 @@

   resources:
   - nodes
   verbs:
   - get
   - list
   - watch
-- apiGroups:
-  - storage.k8s.io
-  resources:
-  - csinodes
-  verbs:
-  - get
-  - list
-  - watch
 
--- HelmRelease: rook-ceph/rook-ceph Deployment: rook-ceph/rook-ceph-operator

+++ HelmRelease: rook-ceph/rook-ceph Deployment: rook-ceph/rook-ceph-operator

@@ -26,13 +26,13 @@

       - effect: NoExecute
         key: node.kubernetes.io/unreachable
         operator: Exists
         tolerationSeconds: 5
       containers:
       - name: rook-ceph-operator
-        image: rook/ceph:v1.14.7
+        image: docker.io/rook/ceph:v1.16.2
         imagePullPolicy: IfNotPresent
         args:
         - ceph
         - operator
         securityContext:
           capabilities: