Skip to content

Deprecate netNamespaceFilePath for Pod networking/restart feature #6436

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
nixpanic wants to merge 4 commits into
base: devel
Choose a base branch
from
Open

Deprecate netNamespaceFilePath for Pod networking/restart feature #6436

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
64c636b
helm: set hostPID based on netNamespaceFilePath configuration
nixpanic Jul 29, 2026
5e038ca
deploy: set hostPID to false by default
nixpanic Jul 29, 2026
e71666e
doc: add deprecation notice for netNamespaceFilePath
nixpanic Jul 29, 2026
659bf3b
doc: log deprecation warning for netNamespaceFilePath
nixpanic Jul 29, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 7 additions & 0 deletions PendingReleaseNotes.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,3 +5,10 @@
## Features

## NOTE

## Deprecations

- The `netNamespaceFilePath` configuration option is now deprecated and will be
removed in a future release. Users should migrate to using host networking for

@black-dragon74 black-dragon74 Jul 31, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Static manifests already have host networking, maybe expand the release notes to include:

  • hostPID was changed from true to false in all static manifests
  • Static manifest users with netNamespaceFilePath must manually set hostPID: true
  • OpenShift users must also keep allowHostPID: true in their SCC (if they were using it)

CSI plugin pods instead. When this feature is detected, a deprecation warning
will be logged at the WARNING level.
4 changes: 2 additions & 2 deletions api/deploy/ocp/scc.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,8 +14,8 @@ priority:
allowedCapabilities: ["SYS_ADMIN"]
# Needed as we run liveness container on daemonset pods
allowHostPorts: true
# Needed as we are setting this in RBD plugin pod
allowHostPID: true
# Set to true when netNamespaceFilePath is configured
allowHostPID: false
Comment thread
black-dragon74 marked this conversation as resolved.
# Required for encryption
allowHostIPC: true
# Set to false as we write to RootFilesystem inside csi containers
Expand Down
9 changes: 9 additions & 0 deletions charts/ceph-csi-cephfs/templates/nodeplugin-daemonset.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,7 +42,16 @@ spec:
priorityClassName: {{ .Values.nodeplugin.priorityClassName }}
{{- end }}
hostNetwork: true
{{- $hostPID := false }}
{{- range .Values.csiConfig }}
{{- if and .cephFS .cephFS.netNamespaceFilePath }}
{{- $hostPID = true }}
{{- end }}
{{- end }}
{{- if $hostPID }}
# set to true when netNamespaceFilePath is configured
hostPID: true
{{- end }}
# to use e.g. Rook orchestrated cluster, and mons' FQDN is
# resolved through k8s service, set dns policy to cluster first
dnsPolicy: ClusterFirstWithHostNet
Expand Down
9 changes: 9 additions & 0 deletions charts/ceph-csi-rbd/templates/nodeplugin-daemonset.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,7 +39,16 @@ spec:
securityContext: {{ toYaml .Values.nodeplugin.podSecurityContext | nindent 8 }}
serviceAccountName: {{ include "ceph-csi-rbd.serviceAccountName.nodeplugin" . }}
hostNetwork: true
{{- $hostPID := false }}
{{- range .Values.csiConfig }}
{{- if and .rbd .rbd.netNamespaceFilePath }}
{{- $hostPID = true }}
{{- end }}
{{- end }}
{{- if $hostPID }}
# set to true when netNamespaceFilePath is configured
hostPID: true
{{- end }}
{{- if .Values.nodeplugin.priorityClassName }}
priorityClassName: {{ .Values.nodeplugin.priorityClassName }}
{{- end }}
Expand Down
3 changes: 2 additions & 1 deletion deploy/cephfs/kubernetes/csi-cephfsplugin.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,8 @@ spec:
serviceAccountName: cephfs-csi-nodeplugin
priorityClassName: system-node-critical
hostNetwork: true
hostPID: true
# set to true when netNamespaceFilePath is configured
hostPID: false
# to use e.g. Rook orchestrated cluster, and mons' FQDN is
# resolved through k8s service, set dns policy to cluster first
dnsPolicy: ClusterFirstWithHostNet
Expand Down
3 changes: 2 additions & 1 deletion deploy/nfs/kubernetes/csi-nfsplugin.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,8 @@ spec:
serviceAccountName: nfs-csi-nodeplugin
priorityClassName: system-node-critical
hostNetwork: true
hostPID: true
# set to true when netNamespaceFilePath is configured
hostPID: false
# to use e.g. Rook orchestrated cluster, and mons' FQDN is
# resolved through k8s service, set dns policy to cluster first
dnsPolicy: ClusterFirstWithHostNet
Expand Down
3 changes: 2 additions & 1 deletion deploy/nvmeof/kubernetes/csi-nvmeofplugin.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -109,7 +109,8 @@ spec:
name: registration-dir
dnsPolicy: ClusterFirstWithHostNet
hostNetwork: true
hostPID: true
# set to true when netNamespaceFilePath is configured
hostPID: false
priorityClassName: system-node-critical
restartPolicy: Always
schedulerName: default-scheduler
Expand Down
3 changes: 2 additions & 1 deletion deploy/rbd/kubernetes/csi-rbdplugin.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,8 @@ spec:
spec:
serviceAccountName: rbd-csi-nodeplugin
hostNetwork: true
hostPID: true
# set to true when netNamespaceFilePath is configured
hostPID: false
priorityClassName: system-node-critical
# to use e.g. Rook orchestrated cluster, and mons' FQDN is
# resolved through k8s service, set dns policy to cluster first
Expand Down
4 changes: 2 additions & 2 deletions deploy/scc.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,8 +21,8 @@ priority:
allowedCapabilities: ["SYS_ADMIN"]
# Needed as we run liveness container on daemonset pods
allowHostPorts: true
# Needed as we are setting this in RBD plugin pod
allowHostPID: true
# Set to true when netNamespaceFilePath is configured
allowHostPID: false
# Required for encryption
allowHostIPC: true
# Set to false as we write to RootFilesystem inside csi containers
Expand Down
4 changes: 4 additions & 0 deletions examples/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -52,6 +52,10 @@ option `clusterID`, can now be created on the cluster.

## Running CephCSI with pod networking

> **DEPRECATION NOTICE**: The `netNamespaceFilePath` feature is deprecated and
> will be removed in a future version. Users should migrate to using host
> networking for CSI plugin pods.

The current problem with Pod Networking, is when a CephFS/RBD/NFS volume is mounted
in a pod using Ceph CSI and then the CSI CephFS/RBD/NFS plugin is restarted or
terminated (e.g. by restarting or deleting its DaemonSet), all operations on
Expand Down
4 changes: 4 additions & 0 deletions internal/cephfs/nodeserver.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -252,6 +252,10 @@ func (ns *cephfsNodeServer) NodeStageVolume(
if err != nil {
return nil, status.Error(codes.Internal, err.Error())
}
if volOptions.NetNamespaceFilePath != "" {
log.WarningLog(ctx, "netNamespaceFilePath is deprecated and will be removed in a future version. "+
"Please migrate to using host networking for CSI plugin pods.")
}
}

if volOptions.BackingSnapshot {
Expand Down
4 changes: 4 additions & 0 deletions internal/nfs/nodeserver/nodeserver.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -110,6 +110,10 @@ func (ns *nfsNodeServer) NodePublishVolume(
if err != nil {
return nil, status.Error(codes.Internal, err.Error())
}
if netNamespaceFilePath != "" {
log.WarningLog(ctx, "netNamespaceFilePath is deprecated and will be removed in a future version. "+
"Please migrate to using host networking for CSI plugin pods.")
}
}

err = ns.mountNFS(ctx,
Expand Down
4 changes: 4 additions & 0 deletions internal/rbd/nodeserver.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -392,6 +392,10 @@ func (ns *NodeServer) NodeStageVolume(
if err != nil {
return nil, status.Error(codes.Internal, err.Error())
}
if rv.NetNamespaceFilePath != "" {
log.WarningLog(ctx, "netNamespaceFilePath is deprecated and will be removed in a future version. "+
"Please migrate to using host networking for CSI plugin pods.")
}
if isHealer {
err = healerStageTransaction(ctx, cr, rv, stagingParentPath)
if err != nil {
Expand Down
4 changes: 2 additions & 2 deletions vendor/github.com/ceph/ceph-csi/api/deploy/ocp/scc.yaml
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.