v2.12.0-rc.1

Another feature release that warrents a longer RC phase. We also dropped support for old Kubernetes versions, our new version floor is 1.30.

This time, we improved support for shared storage setup (think: SAN attached to all nodes). You can now set up such storage pools and use them like any other pool to provision your volumes, not needing any replication using DRBD.

We also added full support for rotating the TLS certificates in all components, so rotated certificates are automatically picked up.

Finally, we cleaned up our RBAC, which means we default to use cluster wide read permissions for secrets. If you are using LINSTOR Backups to S3, you need read the upgrade guide.

---

Added

• Support shared LVM storage pools: setting lvmPool.sharedSpace registers the storage pool as backed by storage
  shared between nodes, optionally using an external lock manager such as lvmlockd (lvmPool.externalLocking).
• Support rotation of Satellite TLS certificates: with internalTLS enabled, the Satellite container will restart
  to pick up a rotated certificate.
• Support rotation of Controller TLS certificates: with internalTLS or apiTLS enabled, restarting the Controller
  container to pick up a rotated certificate.

Changed

• The minimum supported Kubernetes version is now v1.30.

Removed

• Removed the cluster-wide permission to read Secrets from the CSI controller: access to Secrets referenced in a VolumeSnapshotClass, such as S3 credentials, now needs to be granted explicitly.
• Removed the cluster-wide permission to read and modify Secrets from the Operator: it now manages Secrets only in its own namespace, using a namespaced Role.
• Removed the deprecated csi-health-monitor sidecar (csi-external-health-monitor-controller) from the CSI controller
  deployment, along with its RBAC rules and default image.

Fixed

• Actually merge the host's lvm.conf and lvmlocal.conf into the LVM configuration used by the satellite, and copy over LVM profiles from the host.