mirror of
https://github.com/cozystack/cozystack.git
synced 2026-11-09 14:02:56 +09:00
Andrei Kvapil
8ae9009270
## What this PR does Bumps the LINSTOR storage stack to current upstream, picking up the published security fixes the issue enumerates: - `linstor-server` (piraeus-server) `1.33.2 → 1.33.3` (latest 1.33 patch; v1.34.0 is rc-only). Pulls in the 1.33.3 DRBD fixes (clone-status check before connection states arrive; the secondary-after-mkfs path is now guarded upstream too) plus refreshed Debian packages. Note: 1.33.3 also disables DRBD volume shrink upstream (it never worked correctly) — no effect on cozystack, which does not expose volume shrink. - `linstor-csi` `v1.10.6 → v1.11.2`. Its go.mod requires Go ≥ 1.26, so the CSI builder moves `golang:1.25 → golang:1.26` — the right lever for the Go stdlib / `moby/spdystream` CVEs. Both cozystack images are rebuilt multi-arch (linux/amd64 + linux/arm64) and pinned by digest in `values.yaml`. All five piraeus-server patches re-apply cleanly against v1.33.3 in the Dockerfile glob order, and both linstor-csi patches re-apply against v1.11.2. Adds helm-unittest coverage (the package shipped none) asserting the controller / CSI / satellite images stay digest-pinned (`<image>:<tag>@sha256:<64-hex>`), version-agnostic so it survives the release-prepare re-tag. **Verified on a dev cluster:** a rolling restart of all satellites, controller, and CSI to 1.33.3 / v1.11.2 kept every node Online with zero faulty resources; a replicated PVC provisioned, mkfs'd, and reached UpToDate across 3 nodes with no DRBD "device held open" abort (the cozystack secondary-after-mkfs patch handled the path). The csi v1.11.2 "no RWX without DRBD layer" change is a no-op for cozystack, which always uses the DRBD layer. Closes #2881 ### Release note ```release-note chore(linstor): bump linstor-server to 1.33.3 and linstor-csi to v1.11.2 Upgrade impact: an empty tenant Kubernetes worker `nodeGroups[*].storageClass` now defaults to the application-level (DRBD `replicated`) storageClass instead of the management-cluster default, because linstor-csi v1.11.2 rejects ReadWriteMany volumes on a non-DRBD storage class. This changes the rendered worker template, so existing tenant clusters that relied on the empty-storageClass default roll their worker MachineDeployments once on the first reconcile after upgrade — workers are reprovisioned on the application storageClass and container images are re-pulled. The per-nodeGroup override and the both-empty cluster-default escape hatch are preserved. ``` <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Updated LINSTOR Server to **v1.33.3** and LINSTOR CSI to **v1.11.2** (image tags/digest pins refreshed) * Updated the LINSTOR CSI build toolchain to **Go 1.26** * Added a **test** make target to run Helm unit tests * **Documentation** * Updated the LINSTOR Server patches README to reference **v1.33.3** * **Tests** * Added an image-pinning validation suite to confirm controller and satellite images use **sha256** digests <!-- end of auto-generated comment: release notes by coderabbit.ai --> ## Worker-disk storageClass default (companion to the bump) linstor-csi v1.11.2 rejects ReadWriteMany volumes that are not on a DRBD-layer storage class. Worker VMs live-migrate, so their disks need RWX — the access mode comes from the chosen StorageClass's CDI StorageProfile (a DRBD class yields RWX), it is not set on the worker DataVolume by the chart. With the bump, a worker nodeGroup left on a non-DRBD cluster-default StorageClass would fail provisioning, so an empty per-nodeGroup storageClass now defaults to the application storageClass (replicated/DRBD) instead of the cluster default. The per-nodeGroup override and the both-empty cluster-default escape-hatch are preserved. Upgrade impact: the empty-storageClass default ships on `md0`, and the KubevirtMachineTemplate name is content-addressed over the rendered worker body, so this flip renames the template and triggers a one-time CAPI rolling replacement of worker pools on the first reconcile after upgrade. Two hash-pin tests guard the rename so it stays an intentional, reviewed change. linstor-csi v1.11.2 also defaults DRBD two-primaries to kubevirt-only — a no-op for cozystack, where kubevirt is the target.