Rook
v1.20.2Storage & DataJul 8, 2026
Rook v1.20.2 is a routine patch that tightens mgr network policy to ingress-only and bumps Ceph to v20.2.2 and ceph-csi-operator to v1.0.4, alongside several bug fixes and minor enhancements. No CVEs or breaking API changes are included.
securitymgr NetworkPolicy tightened to ingress-only
The mgr NetworkPolicy is now restricted to ingress-only traffic. If you have custom NetworkPolicy rules that rely on mgr egress paths being open by default, review and adjust your network policies after upgrading to v1.20.2.
enhancementCeph bumped to v20.2.2, ceph-csi-operator to v1.0.4
The default Ceph image is updated to v20.2.2 and ceph-csi-operator to v1.0.4. Test these versions in staging if your deployment pins Ceph or CSI operator images explicitly.
Key changes (7)
- mgr NetworkPolicy restricted to ingress-only, closing previously open egress paths (medium severity)
- Ceph default version updated to v20.2.2
- ceph-csi-operator updated to v1.0.4
- Node watcher now triggers reconciliation on label or annotation changes, improving dynamic node handling
- VolumeAttachment resources are correctly removed during unmount in external clusters, preventing stale state
- Mon reschedule floating time reduced for faster failover; node watcher skipped during initial cache sync to suppress spurious reconcile loops at startup
- Smaller fixes: OSD raw-activate path no longer scans rbd devices incorrectly, config overrides now end with a trailing newline, object store realm access keys generated as URL-safe strings; new API for muting Ceph warnings added