Merge branch 'main' into main

Author: jillian-maroket

.github/workflows/test-deploy.yml

@@ -11,7 +11,7 @@ jobs:
     name: Test deployment
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           submodules: recursive
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0

versions/v1.7/modules/en/pages/upgrades/v1-6-x-to-v1-7-x.adoc

@@ -1,7 +1,6 @@
 = Upgrade from v1.6.x to v1.7.x
-:revdate: 2026-06-05
+:revdate: 2026-06-10
 :page-languages: [en, de, es, fr, ja, pt, zh]
-:revdate: 2026-02-02
 :page-revdate: {revdate}
 
 == General information
@@ -259,22 +258,26 @@ $ grub2-editenv /oem/grubenv set \
 
 [NOTE]
 ====
-This workaround is only necessary when upgrading to v1.7.0 or using bonded interfaces. In v1.7.1 and later versions, these `ifname=` arguments are automatically added to prevent network disruptions during driver updates.
+This workaround is only necessary when upgrading to v1.7.0, or if using bonded interfaces with v1.7.1. In v1.7.2 and later versions, these `ifname=` arguments are automatically added to prevent network disruptions during driver updates.
 
 |===
-| Version | Interface | Manual workaround
+| Version | Interface | Workaround
 
 | v1.7.0
 | Any
-| Required
+| Manual
 
-| v1.7.1+
+| v1.7.1
 | Standalone
-| Not required (automated)
+| Automated
 
-| v1.7.1+
+| v1.7.1
 | Bonded
-| Required
+| Manual
+
+| v1.7.2+
+| Any
+| Automated
 |===
 ====
 

versions/v1.8/modules/en/images/upgrade/kubevirt-not-ready.png

@@ -40,6 +40,7 @@
 ** xref:upgrades/v1-6-x-to-v1-6-y.adoc[]
 ** xref:upgrades/v1-6-x-to-v1-7-x.adoc[]
 ** xref:upgrades/v1-7-x-to-v1-7-y.adoc[]
+** xref:upgrades/v1-7-x-to-v1-8-x.adoc[]
 ** xref:upgrades/troubleshooting.adoc[]
 
 // Folder: hosts:
@@ -106,11 +107,12 @@
 ** xref:networking/vm-isolation.adoc[]
 ** xref:networking/best-practices.adoc[]
 
-// Folder: resilience:
+// Folder: security-resilience:
 
-* Resilience
-** xref:resilience/ha-principles.adoc[]
-** xref:resilience/failure-domains.adoc[]
+* Security and Resilience
+** xref:security-resilience/pod-security-standards.adoc[]
+** xref:security-resilience/ha-principles.adoc[]
+** xref:security-resilience/failure-domains.adoc[]
 
 // Folder: observability:
 
@@ -141,6 +143,7 @@
 ** Rancher Integration
 *** xref:integrations/rancher/rancher-integration.adoc[]
 *** xref:integrations/rancher/virtualization-management.adoc[]
+*** xref:integrations/rancher/rancher-rbac.adoc[]
 // Folder: integrations/rancher/node-driver/
 *** Node Driver
 **** xref:integrations/rancher/node-driver/node-driver.adoc[]

versions/v1.8/modules/en/nav.adoc

@@ -1,5 +1,5 @@
 = Settings
-:revdate: 2026-06-05
+:revdate: 2026-06-10
 :page-revdate: {revdate}
 
 The following is a list of advanced settings that you can use. You can modify the `settings.harvesterhci.io` custom resource using both the UI and the `kubectl` command.
@@ -95,6 +95,36 @@ For more information, see the https://documentation.suse.com/cloudnative/storage
 }
 ----
 
+=== `cluster-pod-security-standard`
+
+*Definition*: Setting that allows cluster administrators to enforce Pod Security Standards (PSS) at the cluster level while maintaining granular configuration control at the namespace level.
+
+For more information, see xref:security-resilience/pod-security-standards.adoc[cluster-pod-security-standard].
+
+*Default value*: 
+
+[,json]
+----
+{
+  "enabled":false,
+  "whitelistedNamespacesList":"", 
+  "privilegedNamespacesList":"",
+  "restrictedNamespacesList":""
+}
+----
+
+*Example*:
+
+[,json]
+----
+{
+  "enabled":true,
+  "whitelistedNamespacesList":"namespace1,namespace2,namespace3", 
+  "privilegedNamespacesList":"privileged-ns1,privileged-ns2",
+  "restrictedNamespacesList":"restricted-ns1,restricted-ns2"
+}
+----
+
 === `cluster-registration-url`
 
 *Definition*: JSON object used to import the {harvester-product-name} cluster into {rancher-product-name} for multi-cluster management.

versions/v1.8/modules/en/pages/installation-setup/config/settings.adoc

@@ -1,5 +1,5 @@
 = Harvester CSI Driver
-:revdate: 2026-06-03
+:revdate: 2026-06-09
 :page-revdate: {revdate}
 
 The Harvester Container Storage Interface (CSI) driver provides a standard CSI interface used by guest Kubernetes clusters. It connects to the {harvester-product-name} cluster and hot-plugs volumes to the virtual machines to provide native storage performance.
@@ -510,6 +510,170 @@ Starting with *v0.1.25*, the Harvester CSI Driver supports https://kubernetes.io
 * Harvester CSI Driver v0.1.25 or later
 * The CSI snapshot controller and the required manifests are properly deployed on the guest cluster. These components are deployed by default on RKE2.
 
+== Volume backups
+
+Starting with **v0.1.28**, the Harvester CSI Driver supports remote volume backup and restore for guest Kubernetes clusters. This feature allows you to back up a PersistentVolumeClaim (PVC) to the {harvester-product-name} backup target, and subsequently restore it to either the source guest cluster or a different guest cluster running on the same {harvester-product-name} cluster.
+
+=== Prerequisites
+
+* {harvester-product-name} v1.8 or later
+* Harvester CSI Driver v0.1.28 or later
+* The CSI snapshot controller, along with its required CRDs and deployment manifests, is properly deployed on the guest cluster.
+* A backup target is configured and ready on the {harvester-product-name} cluster.
+
+To verify the status of the CSI snapshot controller and the required CRDs, run the following commands on RKE2:
+
+[,shell]
+----
+$ kubectl  -n kube-system get po -lapp.kubernetes.io/name=rke2-snapshot-controller    
+NAME                                       READY   STATUS    RESTARTS      AGE
+rke2-snapshot-controller-858d65d54-nvlfq   1/1     Running   0             5d17h
+
+$ kubectl get crd --show-labels | grep -i volumesnapshot                         
+volumesnapshotclasses.snapshot.storage.k8s.io                     2026-04-16T23:26:24Z   app.kubernetes.io/managed-by=Helm
+volumesnapshotcontents.snapshot.storage.k8s.io                    2026-04-16T23:26:24Z   app.kubernetes.io/managed-by=Helm
+volumesnapshots.snapshot.storage.k8s.io                           2026-04-16T23:26:24Z   app.kubernetes.io/managed-by=Helm
+----
+
+=== Creating a volume backup
+
+. Create a `VolumeSnapshotClass` for backups on the guest cluster.
++
+[,yaml]
+----
+   apiVersion: snapshot.storage.k8s.io/v1
+   deletionPolicy: Delete
+   driver: driver.harvesterhci.io
+   kind: VolumeSnapshotClass
+   metadata:
+     name: harvester-backup
+   parameters:
+     type: backup
+----
+
+. Create a `VolumeSnapshot` for the source PVC.
++
+[,yaml]
+----
+   apiVersion: snapshot.storage.k8s.io/v1
+   kind: VolumeSnapshot
+   metadata:
+     name: snapshot-fs-vol
+     namespace: default
+   spec:
+     volumeSnapshotClassName: harvester-backup
+     source:
+       persistentVolumeClaimName: fs-vol
+----
+
+. Wait until the `VolumeSnapshot` becomes ready to use.
++
+[,shell]
+----
+kubectl get volumesnapshot snapshot-fs-vol -n default
+----
++
+Once the `VolumeSnapshot` is ready, a corresponding `VolumeRemoteBackup` resource is automatically generated on the underlying {harvester-product-name} cluster for restore operations.
+
+. On the {harvester-product-name} cluster, retrieve a list of the generated `VolumeRemoteBackup` resources.
++
+[,shell]
+----
+kubectl get volumeremotebackups -A
+----
+
+=== Restoring a backup on the same guest cluster
+
+. Create a new PVC and set its `spec.dataSource` to the backup `VolumeSnapshot`.
++
+[,yaml]
+----
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: restore-fs-vol
+  namespace: default
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 2Gi
+  storageClassName: harvester
+  dataSource:
+    apiGroup: snapshot.storage.k8s.io
+    kind: VolumeSnapshot
+    name: snapshot-fs-vol
+  volumeMode: Filesystem
+----
+
+. Once the PVC is bound, mount it to a pod and verify that the restored data is intact.
+
+=== Restoring a backup on a different guest cluster
+
+You can restore a backup on a different guest cluster _running on the same {harvester-product-name} cluster_.
+
+. On the source guest cluster, <<Creating a volume backup, create a backup>>.
+
+. On the target guest cluster, create a `VolumeSnapshotContent` that points to the {harvester-product-name} backup handle in the format `backup:<VolumeRemoteBackup namespace>/<VolumeRemoteBackup name>`.
++
+[,yaml]
+----
+   apiVersion: snapshot.storage.k8s.io/v1
+   kind: VolumeSnapshotContent
+   metadata:
+     name: backup-fs-vol-vsc
+   spec:
+     deletionPolicy: Delete
+     driver: driver.harvesterhci.io
+     source:
+       snapshotHandle: backup:<VolumeRemoteBackup namespace>/<VolumeRemoteBackup name>
+     volumeSnapshotClassName: harvester-backup
+     volumeSnapshotRef:
+            name: backup-fs-vol
+       namespace: default
+----
+
+. Create a `VolumeSnapshot` from the `VolumeSnapshotContent`.
++
+[,yaml]
+----
+   apiVersion: snapshot.storage.k8s.io/v1
+   kind: VolumeSnapshot
+   metadata:
+     name: backup-fs-vol
+     namespace: default
+   spec:
+     volumeSnapshotClassName: harvester-backup
+     source:
+       volumeSnapshotContentName: backup-fs-vol-vsc
+----
+
+. Create a restore PVC from the `VolumeSnapshot`.
++
+[,yaml]
+----
+   apiVersion: v1
+   kind: PersistentVolumeClaim
+   metadata:
+     name: restore-fs-vol
+     namespace: default
+   spec:
+     accessModes:
+       - ReadWriteOnce
+     resources:
+       requests:
+         storage: 2Gi
+     storageClassName: harvester
+     dataSource:
+       apiGroup: snapshot.storage.k8s.io
+       kind: VolumeSnapshot
+       name: backup-fs-vol
+     volumeMode: Filesystem
+----
+
+. Once the PVC is bound, attach it to a workload on the target guest cluster and verify that the data was restored successfully.
+
 == Upgrade the CSI Driver
 
 [NOTE]