Rook
v1.18.10Storage & DataRook v1.18.10 patches several OSD reliability issues, tightens RBAC permissions, and adds minor operational improvements to the Ceph exporter and NFS server.
securityAudit your Rook RBAC after upgrading — nodes/proxy grant is gone
The operator's nodes/proxy RBAC permission has been removed. If any custom tooling or monitoring in your environment relied on Rook's ServiceAccount having that grant, it will break silently after upgrade. Review any pipelines or dashboards that use the Rook operator ServiceAccount before rolling this out to production.
breakingEncrypted OSD users should test key rotation after upgrading
The lockbox key rotation logic for encrypted OSDs was updated. Encrypted OSD clusters should run a non-production upgrade first and explicitly verify key rotation still works end-to-end. The CephX key init fix (no overwrite on failure) also changes behavior during error recovery — test any failure/retry scenarios you have documented.
enhancementUse the new CephNFS image fields to pin or customize NFS server images
The new spec.server.image and spec.server.imagePullPolicy fields let you specify a custom NFS Ganesha image per CephNFS resource. This is useful if you need to pin a specific version for compliance or test a patched image without waiting for a Rook release. Update your CephNFS manifests if you currently work around this with other hacks.
主な変更 (5)
- Orphaned ceph-exporter deployments are now cleaned up automatically during reconcile
- RBAC: nodes/proxy grants removed from the operator — reduces cluster-wide privilege footprint
- Encrypted OSD lockbox key rotation logic updated — important for clusters using OSD encryption
- CephX key init no longer overwrites an existing key on failure — prevents accidental key loss
- CephNFS gains spec.server.image and spec.server.imagePullPolicy fields for custom NFS images