chore(deps): update helm release rook-ceph to v1.20.3

[btkostner-infrastructure]

This PR contains the following updates:

Package	Type	Update	Change
rook-ceph	HelmChart	minor	v1.19.3 → v1.20.3

---

Release Notes

rook/rook (rook-ceph)

v1.20.3

Compare Source

Improvements
Rook v1.20.3 is a patch release limited in scope and focusing on feature additions and bug fixes to the Ceph operator.

• helm: Add toolbox repository and tag settings (#​18042, @​jhoblitt)
• helm: Add multisite CR support to rook-ceph-cluster chart (#​17917, @​jhoblitt)
• nfs: Support custom NFS server port (#​18029, @​raaizik)
• external: Deduplicate external MGR endpoints in EndpointSlice (#​17785, @​beyondcloud-co)
• monitoring: Deduplicate pool growth prediction series (#​17919, @​tjwallace)
• docs: Update node loss handling instructions (#​17790, @​N3rdBot)
• rgw: RGW account deletion should remove account from ceph (#​17962, @​parth-gr)
• core: Update the go text module (#​18024, @​travisn)
• mon: Fix data race on failedMonSchedule during scheduling (#​17968, @​anxkhn)
• mon: Update how hostname is set for drbd (#​17689, @​subhamkrai)
• csi: Do not log peer bootstrap token secret (#​17965, @​anxkhn)
• file: Reveal swallowed errors on cephfs reconciliation (#​17920, @​XT-Phate)

v1.20.2

Compare Source

Improvements

Rook v1.20.2 is a patch release limited in scope and focusing on feature additions and bug fixes to the Ceph operator.

• ceph: Update ceph version to latest v20.2.2 (#​17774, @​subhamkrai)
• csi: Update ceph-csi-operator version to v1.0.4 (#​17875, @​subhamkrai)
• core: Trigger reconcile when node labels or annotations change (#​17847, @​anxkhn)
• docs: Add Kubernetes and Ceph version support matrix (#​17871, @​jhoblitt)
• core: Add api changes to mute ceph warnings (#​17764, @​subhamkrai)
• external: VolumeAttachment should be deleted during unmount (#​17826, @​parth-gr)
• core: Ensure config overrides end with a trailing newline (#​17758, @​kavirakesh14)
• core: Skip node watcher during initial cache sync (#​17812, @​travisn)
• core: Reduce the floating mon reschdule time (#​17805, @​parth-gr)
• osd: Do not scan rbd devices in raw activate fallback (#​17724, @​jhoblitt)
• security: Restrict mgr NetworkPolicy to ingress-only (#​17827, @​OdedViner)
• security: Add example NetworkPolicy CRs for Ceph operand pods (#​17559, @​OdedViner)
• object: Generate URL-safe realm access keys (#​17710, @​jhoblitt)
• ci: Numerous CI stability updates (@​jhoblitt)

v1.20.1

Compare Source

Improvements

Rook v1.20.1 is a patch release limited in scope and focusing on feature additions and bug fixes to the Ceph operator.

• helm: Add rook compatible ceph csi driver values (#​17665, @​subhamkrai)
• osd: Ensure require-osd-release set after a major Ceph upgrade (#​17546, @​Sunnatillo)
• build: bump golang.org/x/crypto to v0.52.0 (#​17718, @​subhamkrai)
• nvmeof: Use Ceph default gateway image when not specified in the nvmeof CR (#​17701, @​OdedViner)
• core: Delete stale MDS and RGW pdbs (#​17700, @​sp98)
• osd: Support using node labels for OSD device class assignment (#​17649, @​yuxiang-he)
• csi: Disable csi-addons by default (#​17664, @​subhamkrai)
• object: Clobber bucket policy on modify instead of merging (#​17643, @​archy-rock3t-cloud)
• docs: Add an install guide for Two-Node Fenced clusters (#​17628, @​parth-gr)
• docs: Add prerequisite to run udev (#​17760, @​sp98)
• docs: External cluster documentation updated for the CSI operator (#​17690, @​parth-gr)
• docs: Update csi-driver value.yaml reference link (#​17674, @​subhamkrai)

v1.20.0

Compare Source

Upgrade Guide

To upgrade from previous versions of Rook, see the Rook upgrade guide.

Breaking Changes

• The Ceph CSI operator is required for managing CSI driver settings.
  • Upgrades will continue working with the existing settings that had been applied by Rook previously. Further updates to CSI settings will need to be updated by the Rook admin. Clusters with default CSI settings do not require customizations.
  • CSI settings are removed from the Rook operator configmap rook-ceph-operator-config and the rook-ceph Helm chart.
  • New installs must configure the CSI settings with the Ceph-CSI OperatorConfig and Driver CRs. Default settings are included in operator.yaml. For custom CSI settings, see the CSI Configuration for more details and examples.
  • For helm users, the Ceph CSI operator settings are configured by the ceph-csi-drivers chart. Custom CSI images remain configured by the rook-ceph chart values.

Features

• Supported Kubernetes versions are v1.31 through v1.36.
• SSE-S3 with Vault Agent: Added support for server-side encryption with SSE-S3 using HashiCorp Vault Agent authentication. See the CephObjectStore Security Settings for more details.
• Unused CRUSH rule cleanup: Rook now deletes unused CRUSH rules by default after the Ceph mgr starts. If unused CRUSH rules should not be deleted, set ROOK_DELETE_UNUSED_CRUSH_RULES to false in the operator config.
• Concurrently reconciling multiple Ceph Clusters with the setting ROOK_RECONCILE_CONCURRENT_CLUSTERS is declared stable.
• Containers within a pod are now consistently reconciled by name instead of relying on the order in which they are declared. This is a defensive measure against the declaration order changing due to manipulation by a mutating webhook.
• OSD resize with encrypted host-based OSDs: For encrypted OSDs (with encryptedDevice: true) with host-based (non-PVC) clusters, resizing the underlying disk now automatically expands encrypted OSDs.
• RGW Accounts (Experimental): The CephObjectStoreAccount CRD manages RGW accounts. The accountReffield is added inCephObjectStoreUser to associate users with accounts. This feature is currently only testable with the Ceph main branch image (quay.ceph.io/ceph-ci/ceph:main`). See the Object Store Accounts documentation for more details.
• Two-node clusters (Experimental): Rook allows a "floating" mon to migrate between the two nodes in case one node is down.

v1.19.8

Compare Source

Improvements

Rook v1.19.8 is a patch release limited in scope and focusing on feature additions and bug fixes to the Ceph operator.

• core: Update the go text module (#​18024, @​travisn)
• object: Clobber bucket policy on modify instead of merging (#​17643, @​archy-rock3t-cloud)
• file: Reveal swallowed errors on cephfs reconcile (#​17920, @​XT-Phate)
• external: Volume attachment should be deleted during unmount (#​17826, @​parth-gr)
• core: Skip node watcher during initial cache sync (#​17812, @​travisn)

v1.19.7

Compare Source

Improvements

Rook v1.19.7 is a patch release limited in scope and focusing on feature additions and bug fixes to the Ceph operator.

• build: Set default version of Ceph to 19.2.4 (#​17629, @​subhamkrai)
• helm: Set helm ownership for csi resources if operator chart is configured (#​17717, @​subhamkrai)
• core: Delete stale MDS and RGW PDBs (#​17700, @​sp98)
• osd: Support using node labels for OSD device class assignment (#​17649, @​yuxiang-he)
• osd: Ensure require-osd-release is set after rolling upgrade (#​17546, @​Sunnatillo)

v1.19.6

Compare Source

Improvements

Rook v1.19.6 is a patch release limited in scope and focusing on feature additions and bug fixes to the Ceph operator.

• helm: Update prometheus rules from upstream ceph/ceph; add cluster label to all scraped metrics (#​17544, @​jhoblitt)
• osd: Honor per-device deviceClass in raw-mode prepare and reconcile (#​17407, @​arttor)
• mgr: Retry self-signed cert creation on wrapped context deadline errors (#​17472, @​texasich)
• mon: Check node existence on every health check iteration (#​17484, @​taraasrita10)
• core: Add default ResourceRequirements for cmd-reporter (#​17464, @​jhoblitt)
• osd: Detect encryption label from dmcrypt path (#​17453, @​sp98)
• exporter: Set correct DNSPolicy for rook-ceph-exporter (#​17451, @​rohan47)
• doc: Add CSI operator resource cleanup steps to teardown guide (#​17286, @​lumir-sliva)
• build: Bump golang.org/x/net to fix govulncheck ci failure (#​17504, @​OdedViner)
• build: Bump github.com/moby/spdystream from 0.5.0 to 0.5.1 (#​17364, @​dependabot[bot])
• ci: bump golang.org/x/net to v0.55.0 to fix GO-2026-5026 (#​17582, @​OdedViner)
• ci: bump and/or pin github action versions (#​17577, @​jhoblitt)

v1.19.5

Compare Source

Improvements

Rook v1.19.5 is a patch release limited in scope and focusing on feature additions and bug fixes to the Ceph operator.

• security: Grant scc to rook-ceph-nvmeof service account (#​17432, @​OdedViner)
• core: Remove newlines from liveness probe scripts (#​17420, @​sp98)
• csi: Add helm ownership annotation to csi resources (#​17289, @​subhamkrai)
• osd: Fix CRUSH device class not applied during OSD re-discovery (#​17228, @​ormandj)
• mds: Fix incorrect behaviour for CephFS when no active standby (#​17373, @​degorenko)
• doc: Fix out of date references to default PgHealthyRegex (#​17376, @​elias-dbx)
• build(deps): Bump github.com/go-jose/go-jose/v4 from 4.1.3 to 4.1.4 (#​17300, @​dependabot[bot])
• mon: Prevent mon drains more reliably when mons are down (#​17359, @​travisn)
• helm: Set ROOK_UNREACHABLE_NODE_TOLERATION_SECONDS from chart values (#​17352, @​taraasrita10)
• csi: Swapped provisionerPriorityClassName with pluginPriorityClassName (#​17361, @​sonnysasaka)
• csi: Add 'CSIMetadataRadosNamespace' parameter to CephFilesystemSubVolumeGroup (#​17351, @​ein-stein-chen)

v1.19.4

Compare Source

Improvements

Rook v1.19.4 is a patch release limited in scope and focusing on feature additions and bug fixes to the Ceph operator.

• object: Fix CephObjectStoreUser support for setting Capabilities (#​17149, @​hjk068)
• mgr: Add missing RBAC role for ceph-mgr in secondary clusters (#​17324, @​gonzolino)
• deploy/examples: Add standalone cleanup-job.yaml (#​17262, @​mateenali66)
• osd: Add logging when detecting osd versions (#​17320, @​travisn)
• build: Update base image for Rook operator to v20.2.1 (#​16836, @​subhamkrai)
• cosi: Update default COSI sidecar image version (#​17204, @​takirala)
• ceph: Add labels support to CephObjectStore RGW service (#​17238, @​majiayu000)
• osd: Zap disks for forceful OSD installation (#​17225, @​sp98)
• helm: Update csi operator to v0.6.0 (#​17244, @​travisn)

---

Configuration

📅 Schedule: (in timezone America/Phoenix)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.