feat(helm): update chart rook-ceph-cluster ( v1.18.8 ➔ v1.20.0 )

[renovate]

This PR contains the following updates:

Package	Update	Change
rook-ceph-cluster	minor	v1.18.8 → v1.20.0

---

Release Notes

rook/rook (rook-ceph-cluster)

v1.20.0

Compare Source

Upgrade Guide

To upgrade from previous versions of Rook, see the Rook upgrade guide.

Breaking Changes

• The Ceph CSI operator is required for managing CSI driver settings.
  • Upgrades will continue working with the existing settings that had been applied by Rook previously. Further updates to CSI settings will need to be updated by the Rook admin. Clusters with default CSI settings do not require customizations.
  • CSI settings are removed from the Rook operator configmap rook-ceph-operator-config and the rook-ceph Helm chart.
  • New installs must configure the CSI settings with the Ceph-CSI OperatorConfig and Driver CRs. Default settings are included in operator.yaml. For custom CSI settings, see the CSI Configuration for more details and examples.
  • For helm users, the Ceph CSI operator settings are configured by the ceph-csi-drivers chart. Custom CSI images remain configured by the rook-ceph chart values.

Features

• Supported Kubernetes versions are v1.31 through v1.36.
• SSE-S3 with Vault Agent: Added support for server-side encryption with SSE-S3 using HashiCorp Vault Agent authentication. See the CephObjectStore Security Settings for more details.
• Unused CRUSH rule cleanup: Rook now deletes unused CRUSH rules by default after the Ceph mgr starts. If unused CRUSH rules should not be deleted, set ROOK_DELETE_UNUSED_CRUSH_RULES to false in the operator config.
• Concurrently reconciling multiple Ceph Clusters with the setting ROOK_RECONCILE_CONCURRENT_CLUSTERS is declared stable.
• Containers within a pod are now consistently reconciled by name instead of relying on the order in which they are declared. This is a defensive measure against the declaration order changing due to manipulation by a mutating webhook.
• OSD resize with encrypted host-based OSDs: For encrypted OSDs (with encryptedDevice: true) with host-based (non-PVC) clusters, resizing the underlying disk now automatically expands encrypted OSDs.
• RGW Accounts (Experimental): The CephObjectStoreAccount CRD manages RGW accounts. The accountReffield is added inCephObjectStoreUser to associate users with accounts. This feature is currently only testable with the Ceph main branch image (quay.ceph.io/ceph-ci/ceph:main`). See the Object Store Accounts documentation for more details.
• Two-node clusters (Experimental): Rook allows a "floating" mon to migrate between the two nodes in case one node is down.

v1.19.6

Compare Source

Improvements

Rook v1.19.6 is a patch release limited in scope and focusing on feature additions and bug fixes to the Ceph operator.

• helm: Update prometheus rules from upstream ceph/ceph; add cluster label to all scraped metrics (#​17544, @​jhoblitt)
• osd: Honor per-device deviceClass in raw-mode prepare and reconcile (#​17407, @​arttor)
• mgr: Retry self-signed cert creation on wrapped context deadline errors (#​17472, @​texasich)
• mon: Check node existence on every health check iteration (#​17484, @​taraasrita10)
• core: Add default ResourceRequirements for cmd-reporter (#​17464, @​jhoblitt)
• osd: Detect encryption label from dmcrypt path (#​17453, @​sp98)
• exporter: Set correct DNSPolicy for rook-ceph-exporter (#​17451, @​rohan47)
• doc: Add CSI operator resource cleanup steps to teardown guide (#​17286, @​lumir-sliva)
• build: Bump golang.org/x/net to fix govulncheck ci failure (#​17504, @​OdedViner)
• build: Bump github.com/moby/spdystream from 0.5.0 to 0.5.1 (#​17364, @​dependabot[bot])
• ci: bump golang.org/x/net to v0.55.0 to fix GO-2026-5026 (#​17582, @​OdedViner)
• ci: bump and/or pin github action versions (#​17577, @​jhoblitt)

v1.19.5

Compare Source

Improvements

Rook v1.19.5 is a patch release limited in scope and focusing on feature additions and bug fixes to the Ceph operator.

• security: Grant scc to rook-ceph-nvmeof service account (#​17432, @​OdedViner)
• core: Remove newlines from liveness probe scripts (#​17420, @​sp98)
• csi: Add helm ownership annotation to csi resources (#​17289, @​subhamkrai)
• osd: Fix CRUSH device class not applied during OSD re-discovery (#​17228, @​ormandj)
• mds: Fix incorrect behaviour for CephFS when no active standby (#​17373, @​degorenko)
• doc: Fix out of date references to default PgHealthyRegex (#​17376, @​elias-dbx)
• build(deps): Bump github.com/go-jose/go-jose/v4 from 4.1.3 to 4.1.4 (#​17300, @​dependabot[bot])
• mon: Prevent mon drains more reliably when mons are down (#​17359, @​travisn)
• helm: Set ROOK_UNREACHABLE_NODE_TOLERATION_SECONDS from chart values (#​17352, @​taraasrita10)
• csi: Swapped provisionerPriorityClassName with pluginPriorityClassName (#​17361, @​sonnysasaka)
• csi: Add 'CSIMetadataRadosNamespace' parameter to CephFilesystemSubVolumeGroup (#​17351, @​ein-stein-chen)

v1.19.4

Compare Source

Improvements

Rook v1.19.4 is a patch release limited in scope and focusing on feature additions and bug fixes to the Ceph operator.

• object: Fix CephObjectStoreUser support for setting Capabilities (#​17149, @​hjk068)
• mgr: Add missing RBAC role for ceph-mgr in secondary clusters (#​17324, @​gonzolino)
• deploy/examples: Add standalone cleanup-job.yaml (#​17262, @​mateenali66)
• osd: Add logging when detecting osd versions (#​17320, @​travisn)
• build: Update base image for Rook operator to v20.2.1 (#​16836, @​subhamkrai)
• cosi: Update default COSI sidecar image version (#​17204, @​takirala)
• ceph: Add labels support to CephObjectStore RGW service (#​17238, @​majiayu000)
• osd: Zap disks for forceful OSD installation (#​17225, @​sp98)
• helm: Update csi operator to v0.6.0 (#​17244, @​travisn)

v1.19.3

Compare Source

Improvements

Rook v1.19.3 is a patch release limited in scope and focusing on feature additions and bug fixes to the Ceph operator.

• csi: Use ceph-csi-operator to deploy Ceph-CSI/NVMe-oF (#​17154, @​nixpanic)
• csi: Update ceph-csi image to v3.16.2 (#​17184, @​black-dragon74)
• csi: Update CSI sidecars to latest versions available (#​17119, @​iPraveenParihar)
• pool: Clean up erasure code profile on pool deletion (#​17208, @​OdedViner)
• pool: Set EC pool status to ready after reconcile (#​17200, @​OdedViner)
• pool: Skip mirroring if the data pool is erasure-coded (#​17143, @​parth-gr)
• exporter: Delete orphaned ceph-exporter deployments on reconcile (#​17165, @​adilGhaffarDev)
• exporter: Reconcile as best effort during deletion and ensure all clusters reconciled (#​17164, @​travisn)
• exporter: Add configurable port for ceph exporter (#​17116, @​OdedViner)
• rgw: Create correct IPv6 formatted secret for object store users (#​17161, @​parth-gr)
• helm: Allow annotations and labels for CephCluster (#​17046, @​sathieu)
• osd: Check devlinks while cleaning osd disks (#​17123, @​sp98)
• osd: Update lockbox key rotation for encrypted OSDs (#​17112, @​BlaineEXE)
• osd: Set device-type label on update (#​17113, @​satoru-takeuchi)
• rgw: Support new RGW pools in shared pools zone json config (#​17102, @​arttor)
• rgw: ObjectStore controller to wait until zone and sharedPools are reconciled (#​17101, @​arttor)

v1.19.2

Compare Source

Improvements

Rook v1.19.2 is a patch release limited in scope and focusing on feature additions and bug fixes to the Ceph operator.

• csi: Update imagePullPolicy in operatorconfig and driver CR (#​17084, @​iPraveenParihar)
• osd: Fix OSDs on multipath device with metadata device (#​17083, @​satoru-takeuchi)
• build: Publish images with buildx instead of manifest-tool (#​17079, @​subhamkrai)
• rgw: Update status info when http is disabled (#​17050, @​sp98)
• object: Add ObjectStoreUserSpec.OpMask field (#​17037, @​jhoblitt)
• exporter: Add log collector for ceph exporter pod (#​16584, @​subhamkrai)
• csi: Update ceph-csi image to 3.16.1 (#​17060, @​iPraveenParihar)
• build(deps): bump sigs.k8s.io/controller-runtime from 0.22.4 to 0.23.0 in the k8s-dependencies group (#​16963, @​dependabot[bot])
• osd: In cephx key init, don't overwrite key on failure (#​17052, @​BlaineEXE)
• nvmeof: Add default gateway topology spread constraints (#​17074, @​OdedViner)
• nvmeof: Update expansion fields and sidecar images (#​17019, @​OdedViner)

v1.19.1

Compare Source

Improvements

Rook v1.19.1 is a patch release limited in scope and focusing on feature additions and bug fixes to the Ceph operator.

csi: Update to ceph csi operator to v0.5 (#​17029, @​subhamkrai)
security: Remove unnecessary nodes/proxy RBAC enablement (#​16979, @​ibotty)
helm: Set default ceph image pull policy (#​16954, @​travisn)
nfs: Add CephNFS.spec.server.{image,imagePullPolicy} fields (#​16982, @​jhoblitt)
osd: Assign correct osd container in case it is not index 0 (#​16969, @​kyrbrbik)
csi: Remove obsolete automated node fencing code (#​16922, @​subhamkrai)
osd: Enable proper cancellation during OSD reconcile (#​17022, @​sp98)
csi: Allow running the csi controller plugin on host network (#​16972, @​Madhu-1)
rgw: Update ca bundle mount perms to read-all (#​16968, @​BlaineEXE)
mon: Change do-not-reconcile to be more granular for individual mons (#​16939, @​travisn)
build(deps): Bump the k8s-dependencies group with 6 updates (#​16846, @​dependabot[bot])
doc: add csi-operator example in configuration doc (#​17001, @​subhamkrai)

v1.19.0

Compare Source

Upgrade Guide

To upgrade from previous versions of Rook, see the Rook upgrade guide.

Breaking Changes

• The supported Kubernetes versions are v1.30 - v1.35
• The minimum supported Ceph version is v19.2.0. Rook v1.18 clusters running Ceph v18 must upgrade
  to Ceph v19.2.0 or higher before upgrading Rook.
• The behavior of the activeStandby property in the CephFilesystem CRD has changed. When set to false, the standby MDS daemon deployment will be scaled down and removed, rather than only disabling the standby cache while the daemon remains running.
• Helm: The rook-ceph-cluster chart has changed where the Ceph image is defined, to allow separate settings for the repository and tag. For more details, see the Rook upgrade guide.
• In external mode, when users provide a Ceph admin keyring to Rook, Rook will no longer create CSI Ceph clients automatically. This approach will provide more consistency to configure external mode clusters via the same external Python script.

Features

• Experimental: NVMe over Fabrics (NVMe-oF) allows RBD volumes to be exposed and accessed via the NVMe/TCP protocol. This enables both Kubernetes pods within the cluster and external clients outside the cluster to connect to Ceph block storage using standard NVMe-oF initiators, providing high-performance block storage access over the network. See the NVMe-oF Configuration Guide to get started.
• CephCSI v3.16 Integration:
  • NVMe-oF CSI driver for provisioning and mounting volumes over the NVMe over Fabrics protocol
  • Improved fencing for RBD and CephFS volumes during node failure
  • Block volume usage statistics
  • Configurable block encryption cipher
• Experimental: Allow concurrent reconciles of the CephCluster CR when there multiple clusters being managed by the same Rook operator. Concurrency is enabled by increasing the operator setting ROOK_RECONCILE_CONCURRENT_CLUSTERS to a value greater than 1.
• Improved logging with namespaced names for the controllers for more consistency in troubleshooting the rook operator log.

v1.18.11

Compare Source

Improvements

Rook v1.18.11 is a patch release limited in scope and focusing on feature additions and bug fixes to the Ceph operator.

• osd: Zap disks for forceful OSD installation (#​17533, @​sp98)
• core: Remove newlines from liveness probe scripts (#​17420, @​sp98)
• csi: Fix swapped provisionerPriorityClassName with pluginPriorityClassName (#​17361, @​sonnysasaka)
• build: Bump github.com/go-jose/go-jose/v4 from 4.1.3 to 4.1.4 (#​17300, @​dependabot[bot])
• doc: Fix out of date references to default PgHealthyRegex (#​17376, @​elias-dbx)
• test: Factor out shared object store creation from ns'd object suite tests (#​17259, @​jhoblitt)

v1.18.10

Compare Source

Improvements

Rook v1.18.10 is a patch release limited in scope and focusing on feature additions and bug fixes to the Ceph operator.

• exporter: Delete orphaned ceph-exporter deployments on reconcile (#​17165, @​adilGhaffarDev)
• exporter: Add log collector for ceph exporter pod (#​16584, @​subhamkrai)
• rbac: Remove nodes/proxy rbac grants (#​16979, @​ibotty)
• osd: Update lockbox key rotation for encrypted OSDs (#​17112, @​BlaineEXE)
• osd: In cephx key init, don't overwrite key on failure (#​17052, @​BlaineEXE)
• osd: Find correct osd container in case it is not index 0 (#​16969, @​kyrbrbik)
• osd: Fix updateExistingOSDs function for cancelled context (#​17022, @​sp98)
• nfs: Add CephNFS.spec.server.{image,imagePullPolicy} fields (#​16982, @​jhoblitt)

v1.18.9

Compare Source

Improvements

Rook v1.18.9 is a patch release limited in scope and focusing on feature additions and bug fixes to the Ceph operator.

• csi: Disable read affinity for ceph v20.2.0 to avoid corruption (#​16895, @​travisn)
• core: Allow skipping cephcluster reconcile via do-not-reconcile label (#​16874, @​OdedViner)
• helm: Merge rook-config-override ConfigMap into toolbox ceph.conf (#​16862, @​mheler)
• helm: Add cephclusters/finalizers permission for mgr sidecar (#​16854, @​grandeit)
• csi: Add fix to support multiple fs mount option (#​16837, @​subhamkrai)
• operator: Watch cephConfigFromSecret changes (#​16786, @​cyanidium)
• rgw: Support all S3 notification events in CRD validation (#​16804, @​arttor)
• docs: Add pool parameter for erasure code optimizations (#​16789, @​travisn)

---

Configuration

📅 Schedule: (in timezone America/New_York)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

qgr1-cluster-0 - kustomization

--- k8s/base/rook-ceph/cluster Kustomization: flux-system/rook-ceph-cluster HelmRelease: rook-ceph/rook-ceph-cluster

+++ k8s/base/rook-ceph/cluster Kustomization: flux-system/rook-ceph-cluster HelmRelease: rook-ceph/rook-ceph-cluster

@@ -13,13 +13,13 @@

     spec:
       chart: rook-ceph-cluster
       sourceRef:
         kind: HelmRepository
         name: rook-ceph-charts
         namespace: flux-system
-      version: v1.18.8
+      version: v1.20.0
   dependsOn:
   - name: rook-ceph
   install:
     createNamespace: true
     remediation:
       retries: 50

[github-actions]

qgr1-cluster-0 - helmrelease

--- HelmRelease: rook-ceph/rook-ceph-cluster CephCluster: rook-ceph/rook-ceph

+++ HelmRelease: rook-ceph/rook-ceph-cluster CephCluster: rook-ceph/rook-ceph

@@ -5,14 +5,14 @@

   name: rook-ceph
   namespace: rook-ceph
 spec:
   monitoring:
     enabled: true
   cephVersion:
+    image: quay.io/ceph/ceph:v20.2.1
     allowUnsupported: false
-    image: quay.io/ceph/ceph:v19.2.3
   cleanupPolicy:
     allowUninstallWithVolumes: false
     confirmation: ''
     sanitizeDisks:
       dataSource: zero
       iteration: 1
@@ -73,12 +73,18 @@

     cleanup:
       limits:
         memory: 1Gi
       requests:
         cpu: 500m
         memory: 100Mi
+    cmd-reporter:
+      limits:
+        memory: 1Gi
+      requests:
+        cpu: 500m
+        memory: 100Mi
     crashcollector:
       limits:
         memory: 60Mi
       requests:
         cpu: 100m
         memory: 60Mi