v1.24.0

Container Image

docker.lightbitslabs.com/lightos-csi/lb-csi-plugin:v1.24.0

IP-ACL enforcement support: The new opt-in ip-acl StorageClass parameter makes the plugin manage each volume's IP-ACL. The node plugin enrolls the node's data-path addresses at stage time and the IP-ACL is reset when the last node detaches. Statically provisioned volumes opt in with the |ipacl:enabled volumeHandle suffix, and the workload-examples charts expose the parameter end to end.
NVMe In-Band Authentication (DH-HMAC-CHAP): With the new inBandAuth Helm value, and against a Lightbits cluster that has in-band authentication enabled, each node self-registers as a trusted host, its secret pair is generated server-side and maintained in the discovery-client configuration, and every NVMe/TCP connection authenticates. On clusters without In-Band Authentication, the plugin keeps the existing connect flow. This requires the in-container discovery-client; the chart will not render otherwise.
The bundled discovery-client fixed a goroutine leak on discovery connection teardown that grew memory use on hosts with unreachable or flapping discovery endpoints.
Static manifests: A new In-Band Authentication flavor, lb-csi-plugin-k8s-v<ver>-dc-iba.yaml, ships for Kubernetes v1.33 and v1.35.

Last updated on

Was this page helpful?