What rook/rook shipped
Written by FoxPlug from the repository's own releases; not affiliated with Rook. Paste your own repository in the box below and FoxPlug writes the same weekly update for your product. This page is an automatic summary of the releases, pull requests and commits in github.com/rook/rook; Rook did not write it and does not use or endorse FoxPlug. Every line links to the change it describes.
Get a weekly update like this for your product, free
Week of October 5, 2026
What shipped
- Rook v1.21.0 was released, with msgrv2 required by default and Helm OCI chart tags no longer including the v prefix. Release
- Mon-specific msgr2 mode options are now set to secure together with the general modes when connection encryption is enabled, closing a gap in secure mesgr2 enforcement. Pull request #18324
- Per-device encryptedDevice: "true" under storage.devices is now respected when creating OSDs, instead of only checking the global encrypted-device flag. Pull request #18472
- The NFS controller no longer creates the.nfs pool automatically; it checks for the pool and requeues with a warning telling the user to create a CephBlockPool. Pull request #18497
- Rook no longer manages the CSI defaults and imageset ConfigMap, leaving empty tags and letting the csi-operator set defaults. Pull request #18420
- The ROOK_CREATE_CSI_OPERATOR_RESOURCES setting was added, defaulting to true, so object-storage-only clusters can skip creating the CephConnection and ClientProfile CRs. Pull request #18373
- The csi-driver and ceph-csi-operator were updated to v3.18.1 and v1.1.0. Pull request #18498
- The NVMe-oF gateway CPU alert now multiplies the busy reactor time rate by 100 so the percentage threshold works and the alert can fire. Pull request #18476
- The nvmeof-protocol canary now pins nvmeof:1.7.23 to fix an aes256k keyring mismatch between the gateway image and Ceph 20.2.4 clusters. Pull request #18520
- The release-1.20 backport for filtering rbd devices from LVM scans in raw-mode activation was corrected in the inline OSD activate script. Pull request #18508
Why it matters
This week brings the v1.21.0 release and several changes that affect how clusters are built and secured. Secure msgr2 handling, per-device encryption and NFS pool creation now behave as expected, and CSI setup is left more to the csi-operator. Users upgrading should note the msgrv2 default and the Helm chart tag change.
Changelog entry
- Release: v1.21.0 Release
- Ceph: enforce secure msgr2 mode for mon connections Pull request #18324
- Osd: respect per-device encryptedDevice config Pull request #18472
- Nfs: remove automatic pool creation in favor of CephBlockPool CR Pull request #18497
- Csi: remove the csi defaults and imageset configmap Pull request #18420
- Csi: add a setting to skip creating the csi operator resources Pull request #18373
- Csi: update csi-driver and ceph-csi-operator Pull request #18498
- Monitoring: correct NVMe-oF gateway CPU alert percentage Pull request #18476
- Ci: pin nvmeof:1.7.23 to fix aes256k keyring mismatch Pull request #18520
- Osd: filter rbd devices from LVM scans in raw-mode activation (release-1.20) Pull request #18508
- Csi: add make target to get latest csi-operator yaml Pull request #18512
- Build: update release version to v1.21.0 Pull request #18516
Rook v1.21.0 is out: msgrv2 required by default and Helm OCI chart tags drop the v prefix. Also this week: mon msgr2 modes enforced, per-device encryptedDevice respected, NFS no longer auto-creates the.nfs pool, and CSI defaults move to the csi-operator.
Rook v1.21.0 is released. Breaking changes to note: msgrv2 is required by default, and Helm OCI chart tags no longer include the v prefix, so update any scripts that reference the chart by tag. Other changes this week: mon-specific msgr2 mode options are now set to secure when connection encryption is enabled. Per-device encryptedDevice: "true" is respected when creating OSDs. The NFS controller no longer creates the.nfs pool automatically and instead asks you to create a CephBlockPool. Rook no longer manages CSI defaults and the imageset ConfigMap, leaving those to the csi-operator. A new ROOK_CREATE_CSI_OPERATOR_RESOURCES setting lets object-storage-only clusters skip CSI CRs. The csi-driver and ceph-csi-operator were updated, and the NVMe-oF gateway CPU alert now compares against the co
Week of September 28, 2026
What shipped
- Rook v1.20.8 released with OSD prepare pod networking fixes and Helm chart improvements. Release
- OSD unit tests now respect the TMPDIR environment variable for ceph-volume failure logs instead of hardcoding /tmp. Pull request #18491
- Raw-mode OSD activation now filters rbd devices from LVM scans to prevent deadlocks on nodes with mapped rbd devices. Pull request #18489
- OSD prepare pods now correctly use the host network when configured with spec.network.provider host. Pull request #18454
- The version detection job now uses the same priority class configured for mon pods. Pull request #18477
- Pool growth alert threshold fixed from 95 to 0.95 in Helm chart rules to match
ceph_pool_percent_usedreporting format. Pull request #18453 - Toolbox pod can now mount additional volumes and environment variables via Helm values for custom CA bundles. Pull request #18165
- Added support for Ceph v21 with upgrade tests included in Rook v1.21. Pull request #18365
- Test suites updated to use Context() instead of context.TODO() following modern Go practices. Pull request #18092
- Design proposed for custom labels on CephObjectStoreUser secrets to enable credential replication with external tools. Pull request #18459
Why it matters
Rook v1.20.8 addresses critical OSD networking and monitoring issues that affect production clusters. The fixes for prepare pod host networking and rbd device filtering resolve deadlock scenarios, while the monitoring alert threshold correction prevents false alerts on growing pools.
Changelog entry
- V1.20.8 released with OSD and Helm improvements Release
- OSD prepare pods respect spec.network.provider host configuration Pull request #18454
- OSD unit tests honor TMPDIR environment variable Pull request #18491
- Raw-mode OSD activation filters rbd devices from LVM scans Pull request #18489
- Version detection job uses mon priority class Pull request #18477
- Pool growth alert threshold corrected to 0.95 Pull request #18453
- Toolbox pod supports additional volumes and environment variables Pull request #18165
- Added support for Ceph v21 Pull request #18365
- Test suites updated to use Context() instead of context.TODO() Pull request #18092
Rook v1.20.8 released with fixes for OSD prepare pod networking on host networks and rbd device filtering in raw-mode activation. Also included: pool growth alert threshold correction and toolbox pod configuration improvements.
Rook v1.20.8 is now available with important stability improvements for OSD operations. This patch release includes fixes for OSD prepare pods on host networks, rbd device handling in raw-mode activation, pool growth alert threshold corrections, and enhanced toolbox configuration options via Helm. These updates address production scenarios and improve monitoring accuracy.
Week of September 21, 2026
What shipped
- Rook now defaults to msgr2 protocol for cluster communication, requiring the msgrv2 protocol that has been available since the 5.11 kernel. Pull request #18090
- Security fix removes command output from unmarshal errors to prevent S3 keys and cephx secrets from reaching logs and Kubernetes events. Pull request #18335
- Helm charts now include default HTTPRoute backend parameters to prevent OutOfSync diffs when deploying with ArgoCD. Pull request #18455
- CSI-Addons sidecar updated to v0.15.1 with latest versions of csi-provisioner, csi-attacher, and related sidecars. Pull request #18366
- The util.retry function now respects context cancellation to prevent retries when cluster specs are updated during retry loops. Pull request #18428
- Object bucket claims can now be created with empty specs, allowing fields like bucket name to be updated separately. Pull request #18416
- Upgrade guide documentation updated for v1.21 release changes. Pull request #18443
- Build system now respects TMPDIR environment variable for temporary files instead of hardcoding /tmp. Pull request #18208
- Mergify automerge rules for release-1.21 backports fixed to use correct Ceph v19 pin for canary tests. Pull request #18440
- CI scorecards job now skips on forks to prevent unwanted nightly runs and stale sweeps outside the main repository. Pull request #18442
Why it matters
This week includes important protocol changes for cluster communication with msgr2 becoming the default, security fixes preventing credential leakage in logs, and infrastructure improvements for better build reliability and CI behavior. These changes improve both security and operational stability for Rook deployments.
Changelog entry
- Default cluster communication protocol changed to msgr2 (requires kernel 5.11+) Pull request #18090
- Security: Remove sensitive data from unmarshal error messages Pull request #18335
- Add default HTTPRoute backend parameters to prevent ArgoCD OutOfSync diffs Pull request #18455
- Update CSI-Addons to v0.15.1 and related sidecars to latest versions Pull request #18366
- Make util.retry context-aware to handle cluster spec updates during retries Pull request #18428
- Allow creating object bucket claims with empty specs Pull request #18416
- Fix TMPDIR handling in build system for sandboxed environments Pull request #18208
- Fix mergify automerge rules for release-1.21 backports Pull request #18440
- Skip CI scorecards job on forks to prevent unwanted automation Pull request #18442
- Update upgrade documentation for v1.21 Pull request #18443
Rook ships msgr2 as the default cluster protocol, security fixes for credential handling, improved CSI sidecars, and better build system support for sandboxed environments.
This week's Rook updates include significant security improvements that prevent S3 keys and Ceph secrets from leaking into logs and Kubernetes events, plus important protocol changes defaulting to msgr2 for cluster communication. We've also shipped CSI-Addons v0.15.1, fixed build system issues in sandboxed environments, and improved the retry logic to respect context cancellation.
Week of September 14, 2026
What shipped
- V1.21.0-beta.0 released. Release
- CephObjectStoreUser now supports optional defaultPlacement and defaultStorageClass fields. Pull request #17260
- RGW zone pool references are now immutable to prevent incorrect updates when users change default placement. Pull request #18399
- Manager Prometheus metrics now support TLS for HTTPS connections. Pull request #18058
- CephBucketNotification accepts five additional lifecycle event values from Ceph Squid and Tentacle. Pull request #18378
- Object Bucket and ObjectBucketClaim CRDs now include printer columns for improved kubectl output. Pull request #18393
- CephNVMeOFGateway fixes hostNetwork toggle recreation and hostname mismatch issues. Pull request #18374
- Ceph-volume logs now redact sensitive lockbox secrets. Pull request #18389
- Build process fixed for cross-compiling gen-toolbox artifact. Pull request #18364
- CI debugging switched from tmate to upterm for pre-job sessions. Pull request #18372
Why it matters
V1.21.0-beta.0 arrives with improvements to object storage configuration immutability, better visibility into buckets via kubectl output, and TLS support for metrics collection. These changes address usability and security concerns for operators managing Rook clusters.
Changelog entry
- CephObjectStoreUser: add optional defaultPlacement and defaultStorageClass fields Pull request #17260
- Manager: add TLS support for Prometheus metrics Pull request #18058
- RGW: make pool references in zones immutable Pull request #18399
- CephBucketNotification: allow five additional lifecycle event values Pull request #18378
- Object Bucket CRDs: add printer columns for kubectl output Pull request #18393
- OSD: redact lockbox secrets from ceph-volume logs Pull request #18389
- NVMeOF: fix hostNetwork toggle and hostname mismatch Pull request #18374
- Library bucket provisioner CRDs: update to v1 with new validation rules Pull request #18363
Rook v1.21.0-beta.0 is out. New features include immutable RGW pool references, object bucket printer columns, and TLS support for Prometheus metrics.
Rook v1.21.0-beta.0 is now available. This release brings several improvements: CephObjectStoreUser gains placement and storage class configuration, RGW zone pools are now immutable to prevent accidental changes, Prometheus metrics support TLS, and object bucket CRDs display better information with kubectl. Additional lifecycle event support and security improvements included.