openshift · shiftstack-merge-bot · Jul 30, 2026 · Sep 4, 2026 · Sep 4, 2026 · Sep 4, 2026
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
@@ -23,6 +23,6 @@ jobs:
           git config user.email "$GITHUB_ACTOR@users.noreply.github.com"
 
       - name: Run chart-releaser
-        uses: helm/chart-releaser-action@a917fd15b20e8b64b94d9158ad54cd6345335584
+        uses: helm/chart-releaser-action@v1.6.0
         env:
           CR_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
diff --git a/.golangci.yaml b/.golangci.yaml
@@ -1,12 +1,6 @@
-version: "2"
-output:
-  formats:
-    text:
-      path: stdout
-      colors: false
-issues:
-  max-same-issues: 0
-  max-issues-per-linter: 0
+run:
+  concurrency: 2
+  timeout: 10m0s
 linters:
   exclusions:
     generated: lax
@@ -22,9 +16,7 @@ linters:
 formatters:
   enable:
     - gofmt
-  exclusions:
-    generated: lax
-    paths:
-      - third_party$
-      - builtin$
-      - examples$
+output:
+  formats:
+    - format: line-number
+      path: stdout
diff --git a/Makefile b/Makefile
@@ -81,7 +81,7 @@ $(BUILD_CMDS): $(SOURCES)
 test: unit functional
 
 check: work
-	go run github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.3.1 run --timeout=20m ./...
+	go run github.com/golangci/golangci-lint/cmd/golangci-lint@v1.61.0 run --timeout=20m ./...
 
 unit: work
 	go test -tags=unit $(shell go list ./... | sed -e '/sanity/ { N; d; }' | sed -e '/tests/ {N; d;}') $(TESTARGS)

diff --git a/OWNERS b/OWNERS
@@ -6,9 +6,11 @@ emeritus_approvers:
 - dulek
 approvers:
 - kayrus
+- mandre
 - stephenfin
 - zetaab
 reviewers:
 - kayrus
+- mandre
 - stephenfin
 - zetaab
diff --git a/charts/cinder-csi-plugin/Chart.yaml b/charts/cinder-csi-plugin/Chart.yaml
@@ -1,8 +1,8 @@
 apiVersion: v1
-appVersion: v1.36.0
+appVersion: v1.31.3
 description: Cinder CSI Chart for OpenStack
 name: openstack-cinder-csi
-version: 2.36.0
+version: 2.31.7
 home: https://github.com/kubernetes/cloud-provider-openstack
 icon: https://github.com/kubernetes/kubernetes/blob/master/logo/logo.png
 maintainers:

diff --git a/charts/cinder-csi-plugin/README.md b/charts/cinder-csi-plugin/README.md
@@ -6,6 +6,7 @@ Deploys a Cinder csi provisioner to your cluster, with the appropriate storageCl
 - Enable deployment of storageclasses using `storageClass.enabled`
 - Tag the retain or delete class as default class using `storageClass.delete.isDefault` in your value yaml
 - Set `storageClass.<reclaim-policy>.allowVolumeExpansion` to `true` or `false`
+- Set `storageClass.<reclaim-policy>.parameters` to add parameters (e.g. `availability` or `type`) to the storageclass
 
 First add the repo:
 

diff --git a/charts/cinder-csi-plugin/ci/snapshotter-disabled-values.yaml b/charts/cinder-csi-plugin/ci/snapshotter-disabled-values.yaml
@@ -0,0 +1,3 @@
+csi:
+  snapshotter:
+    enabled: false
diff --git a/charts/cinder-csi-plugin/ci/snapshotter-enabled-values.yaml b/charts/cinder-csi-plugin/ci/snapshotter-enabled-values.yaml
@@ -0,0 +1,3 @@
+csi:
+  snapshotter:
+    enabled: true
diff --git a/charts/cinder-csi-plugin/ci/topology-disabled-values.yaml b/charts/cinder-csi-plugin/ci/topology-disabled-values.yaml
@@ -0,0 +1,3 @@
+csi:
+  provisioner:
+    topology: "false"
diff --git a/charts/cinder-csi-plugin/templates/controllerplugin-deployment.yaml b/charts/cinder-csi-plugin/templates/controllerplugin-deployment.yaml
@@ -69,7 +69,6 @@ spec:
             - "--timeout={{ .Values.timeout }}"
             - "--leader-election=true"
             - "--default-fstype=ext4"
-            - "--feature-gates=Topology={{ .Values.csi.provisioner.topology }}"
             - "--extra-create-metadata"
             {{- if .Values.csi.provisioner.extraArgs }}
             {{- with .Values.csi.provisioner.extraArgs }}
@@ -86,6 +85,7 @@ spec:
             - name: socket-dir
               mountPath: /var/lib/csi/sockets/pluginproxy/
           resources: {{ toYaml .Values.csi.provisioner.resources | nindent 12 }}
+        {{- if dig "enabled" true .Values.csi.snapshotter }}
         - name: csi-snapshotter
           securityContext:
             {{- toYaml .Values.csi.plugin.controllerPlugin.securityContext | nindent 12 }}
@@ -111,6 +111,7 @@ spec:
             - mountPath: /var/lib/csi/sockets/pluginproxy/
               name: socket-dir
           resources: {{ toYaml .Values.csi.snapshotter.resources | nindent 12 }}
+        {{- end }}
         - name: csi-resizer
           securityContext:
             {{- toYaml .Values.csi.plugin.controllerPlugin.securityContext | nindent 12 }}
@@ -172,6 +173,7 @@ spec:
             - "--cloud-config=$(CLOUD_CONFIG)"
             - "--cluster=$(CLUSTER_NAME)"
             - "--provide-node-service=false"
+            - "--with-topology={{ .Values.csi.provisioner.topology }}"
             {{- if .Values.csi.plugin.httpEndpoint.enabled }}
             - "--http-endpoint=:{{ .Values.csi.plugin.httpEndpoint.port }}"
             {{- end }}
@@ -193,8 +195,10 @@ spec:
               value: unix://csi/csi.sock
             - name: CLOUD_CONFIG
               value: /etc/config/{{ .Values.secret.filename }}
+            {{- if .Values.clusterID }}
             - name: CLUSTER_NAME
               value: "{{ .Values.clusterID }}"
+            {{- end }}
             {{- if .Values.csi.plugin.extraEnv }}
               {{- toYaml .Values.csi.plugin.extraEnv | nindent 12 }}
             {{- end }}
@@ -245,8 +249,8 @@ spec:
       hostAliases:
         {{- toYaml . | nindent 8 }}
       {{- end }}
-    {{- if .Values.priorityClassName }}
-      priorityClassName: {{ .Values.priorityClassName }}
+    {{- if .Values.csi.plugin.controllerPlugin.priorityClassName }}
+      priorityClassName: {{ .Values.csi.plugin.controllerPlugin.priorityClassName }}
     {{- end }}
     {{- with .Values.imagePullSecrets }}
       imagePullSecrets:

diff --git a/charts/cinder-csi-plugin/templates/controllerplugin-rbac.yaml b/charts/cinder-csi-plugin/templates/controllerplugin-rbac.yaml
@@ -88,6 +88,7 @@ roleRef:
   name: csi-provisioner-role
   apiGroup: rbac.authorization.k8s.io
 
+{{- if dig "enabled" true .Values.csi.snapshotter }}
 ---
 kind: ClusterRole
 apiVersion: rbac.authorization.k8s.io/v1
@@ -125,6 +126,7 @@ roleRef:
   kind: ClusterRole
   name: csi-snapshotter-role
   apiGroup: rbac.authorization.k8s.io
+{{- end }}
 ---
 kind: ClusterRole
 apiVersion: rbac.authorization.k8s.io/v1

diff --git a/charts/cinder-csi-plugin/templates/nodeplugin-daemonset.yaml b/charts/cinder-csi-plugin/templates/nodeplugin-daemonset.yaml
@@ -21,6 +21,9 @@ spec:
         {{- include "cinder-csi.nodeplugin.podAnnotations" . | nindent 8 }}
     spec:
       serviceAccount: csi-cinder-node-sa
+      # Host network access is usually necessary if using metadata service,
+      # since not all CNIs support link-local addresses, or if the OpenStack
+      # control plane is on a management network that is not advertised to pods
       hostNetwork: true
       dnsPolicy: {{ .Values.csi.plugin.nodePlugin.dnsPolicy }}
       securityContext:
@@ -82,8 +85,6 @@ spec:
         - name: cinder-csi-plugin
           securityContext:
             privileged: true
-            capabilities:
-              add: ["SYS_ADMIN"]
             allowPrivilegeEscalation: true
           image: "{{ .Values.csi.plugin.image.repository }}:{{ .Values.csi.plugin.image.tag | default .Chart.AppVersion }}"
           imagePullPolicy: {{ .Values.csi.plugin.image.pullPolicy }}
@@ -93,6 +94,7 @@ spec:
             - "--endpoint=$(CSI_ENDPOINT)"
             - "--provide-controller-service=false"
             - "--cloud-config=$(CLOUD_CONFIG)"
+            - "--with-topology={{ .Values.csi.provisioner.topology }}"
             {{- if .Values.csi.plugin.extraArgs }}
             {{- with .Values.csi.plugin.extraArgs }}
             {{- tpl . $ | trim | nindent 12 }}
@@ -177,8 +179,8 @@ spec:
       hostAliases:
         {{- toYaml . | nindent 8 }}
       {{- end }}
-    {{- if .Values.priorityClassName }}
-      priorityClassName: {{ .Values.priorityClassName }}
+    {{- if .Values.csi.plugin.nodePlugin.priorityClassName }}
+      priorityClassName: {{ .Values.csi.plugin.nodePlugin.priorityClassName }}
     {{- end }}
     {{- with .Values.imagePullSecrets }}
       imagePullSecrets:

diff --git a/charts/cinder-csi-plugin/templates/storageclass.yaml b/charts/cinder-csi-plugin/templates/storageclass.yaml
@@ -10,6 +10,10 @@ metadata:
 provisioner: cinder.csi.openstack.org
 reclaimPolicy: Delete
 allowVolumeExpansion: {{ .Values.storageClass.delete.allowVolumeExpansion }}
+{{- with .Values.storageClass.delete.parameters }}
+parameters:
+  {{- toYaml . | nindent 2 }}
+{{- end }}
 ---
 apiVersion: storage.k8s.io/v1
 kind: StorageClass
@@ -22,4 +26,8 @@ metadata:
 provisioner: cinder.csi.openstack.org
 reclaimPolicy: Retain
 allowVolumeExpansion: {{ .Values.storageClass.retain.allowVolumeExpansion }}
-{{- end }}
+{{- with .Values.storageClass.retain.parameters }}
+parameters:
+  {{- toYaml . | nindent 2 }}
+{{- end }}
+{{- end }}
diff --git a/charts/cinder-csi-plugin/values.yaml b/charts/cinder-csi-plugin/values.yaml
@@ -23,6 +23,7 @@ csi:
     extraArgs: {}
     extraEnv: []
   snapshotter:
+    enabled: true
     image:
       repository: registry.k8s.io/sig-storage/csi-snapshotter
       tag: v8.4.0
@@ -90,17 +91,19 @@ csi:
         readOnly: true
     nodePlugin:
       dnsPolicy: ClusterFirstWithHostNet
+      priorityClassName: "system-node-critical"
       # Optional additional annotations to add to the nodePlugin Pods.
       podAnnotations: {}
       # Optional additional labels to add to the nodePlugin Pods.
       podLabels: {}
       podSecurityContext: {}
-      securityContext: {}
-        # capabilities:
-        #   drop:
-        #   - ALL
-        # seccompProfile:
-        #   type: RuntimeDefault
+      securityContext:
+        # Images use distroless/static:latest which runs as root; runAsNonRoot
+        # and allowPrivilegeEscalation cannot be set until upstream switches to
+        # a nonroot base image.
+        readOnlyRootFilesystem: true
+        seccompProfile:
+          type: RuntimeDefault
       affinity: {}
       nodeSelector: {}
       tolerations:
@@ -125,6 +128,7 @@ csi:
           # maxSurge is the maximum number of pods that can be
           # created over the desired number of pods.
           maxSurge: 1
+      priorityClassName: "system-cluster-critical"
       # Optional additional annotations to add to the controllerPlugin Pods.
       podAnnotations: {}
       # Optional additional labels to add to the controllerPlugin Pods.
@@ -135,13 +139,10 @@ csi:
         # runAsGroup: 65532
         # fsGroup: 65532
         # fsGroupChangePolicy: OnRootMismatch
-      securityContext: {}
-        # capabilities:
-        #   drop:
-        #   - ALL
-        # seccompProfile:
-        #   type: RuntimeDefault
-        # readOnlyRootFilesystem: true
+      securityContext:
+        readOnlyRootFilesystem: true
+        seccompProfile:
+          type: RuntimeDefault
       affinity: {}
       nodeSelector: {}
       tolerations: []
@@ -196,9 +197,13 @@ storageClass:
   delete:
     isDefault: false
     allowVolumeExpansion: true
+    # optional parameters for the StorageClass, e.g. availability or type
+    parameters: {}
   retain:
     isDefault: false
     allowVolumeExpansion: true
+    # optional parameters for the StorageClass, e.g. availability or type
+    parameters: {}
 # any kind of custom StorageClasses
 #   custom: |-
 #     ---
@@ -226,8 +231,6 @@ clusterID: "kubernetes"
 # Enable PVC annotations support to create PVCs with extra parameters
 pvcAnnotations: false
 
-priorityClassName: ""
-
 imagePullSecrets: []
 # - name: my-imagepull-secret
 

diff --git a/charts/manila-csi-plugin/Chart.yaml b/charts/manila-csi-plugin/Chart.yaml
@@ -1,8 +1,8 @@
 apiVersion: v1
-appVersion: v1.36.0
+appVersion: v1.31.3
 description: Manila CSI Chart for OpenStack
 name: openstack-manila-csi
-version: 2.36.0
+version: 2.31.3
 home: http://github.com/kubernetes/cloud-provider-openstack
 icon: https://github.com/kubernetes/kubernetes/blob/master/logo/logo.png
 maintainers:

diff --git a/charts/manila-csi-plugin/templates/controllerplugin-statefulset.yaml b/charts/manila-csi-plugin/templates/controllerplugin-statefulset.yaml
@@ -21,6 +21,8 @@ spec:
       containers:
         {{- range .Values.shareProtocols }}
         - name: {{ .protocolSelector | lower }}-provisioner
+          securityContext:
+            {{- toYaml $.Values.controllerplugin.securityContext | nindent 12 }}
           image: "{{ $.Values.controllerplugin.provisioner.image.repository }}:{{ $.Values.controllerplugin.provisioner.image.tag }}"
           args:
             - "-v={{ $.Values.logVerbosityLevel }}"
@@ -44,6 +46,8 @@ spec:
           resources:
 {{ toYaml $.Values.controllerplugin.provisioner.resources | indent 12 }}
         - name: {{ .protocolSelector | lower }}-snapshotter
+          securityContext:
+            {{- toYaml $.Values.controllerplugin.securityContext | nindent 12 }}
           image: "{{ $.Values.controllerplugin.snapshotter.image.repository }}:{{ $.Values.controllerplugin.snapshotter.image.tag }}"
           args:
             - "-v={{ $.Values.logVerbosityLevel }}"
@@ -61,6 +65,8 @@ spec:
           resources:
 {{ toYaml $.Values.controllerplugin.snapshotter.resources | indent 12 }}
         - name: {{ .protocolSelector | lower }}-resizer
+          securityContext:
+            {{- toYaml $.Values.controllerplugin.securityContext | nindent 12 }}
           image: "{{ $.Values.controllerplugin.resizer.image.repository }}:{{ $.Values.controllerplugin.resizer.image.tag }}"
           args:
             - "-v={{ $.Values.logVerbosityLevel }}"
@@ -81,8 +87,6 @@ spec:
         - name: {{ .protocolSelector | lower }}-nodeplugin
           securityContext:
             privileged: true
-            capabilities:
-              add: ["SYS_ADMIN"]
             allowPrivilegeEscalation: true
           image: "{{ $.Values.csimanila.image.repository }}:{{ $.Values.csimanila.image.tag | default $.Chart.AppVersion }}"
           command: ["/bin/sh", "-c",
@@ -101,7 +105,7 @@ spec:
             {{- if .compatibilitySettings }}
             --compatibility-settings={{ .compatibilitySettings }}
             {{- end }}
-            --cluster-id="{{ $.Values.csimanila.clusterID }}"
+            --cluster-id=$(CLUSTER_NAME)
             {{- if $.Values.csimanila.pvcAnnotations }}
             --pvc-annotations
             {{- end }}'
@@ -115,9 +119,17 @@ spec:
               value: "unix://{{ .fwdNodePluginEndpoint.dir }}/{{ .fwdNodePluginEndpoint.sockFile }}"
             - name: MANILA_SHARE_PROTO
               value: "{{ .protocolSelector }}"
+            {{- if $.Values.csimanila.clusterID }}
+            - name: CLUSTER_NAME
+              value: {{ $.Values.csimanila.clusterID }}
+            {{- end }}
             {{- if $.Values.controllerplugin.nodeplugin.extraEnv }}
               {{- toYaml $.Values.controllerplugin.nodeplugin.extraEnv | nindent 12 }}
             {{- end }}
+          {{- with $.Values.controllerplugin.nodeplugin.envFrom }}
+          envFrom:
+          {{- toYaml . | nindent 12 }}
+          {{- end }}
           imagePullPolicy: {{ $.Values.csimanila.image.pullPolicy }}
           volumeMounts:
             - name: {{ .protocolSelector | lower }}-plugin-dir
@@ -174,6 +186,9 @@ spec:
       hostAliases:
         {{- toYaml . | nindent 8 }}
     {{- end }}
+    {{- if .Values.controllerplugin.priorityClassName }}
+      priorityClassName: {{ .Values.controllerplugin.priorityClassName }}
+    {{- end }}
     {{- if .Values.imagePullSecrets }}
       imagePullSecrets:
         {{- toYaml .Values.imagePullSecrets | nindent 8 }}