Portworx Operator Release Notes

25.3.1​

September 06, 2025

Fixes​

25.3.0​

September 03, 2025

New features​

• ComponentK8sConfig: The ComponentK8sConfig custom resource allows configuration of resources, labels, annotations, tolerations, and placement rules for all Portworx components. Configurations previously defined in the StorageCluster should now be migrated to the ComponentK8sConfig custom resource. For more information, see Configure resource limits, placements, tolerations, nodeAffinity, labels, and annotations for Portworx components.

Improvements​

Fixes​

Known issues (Errata)​

• PWX-46691: If Portworx-specific ServiceAccount objects do not include any annotations, the Operator updates these objects during each reconciliation loop. On OpenShift Container Platform (OCP), each ServiceAccount update triggers the regeneration of associated Secret objects, causing excessive Secret creation and unnecessary API traffic. This affects OCP versions 4.15 and earlier.

  Workaround: Add at least one annotation to each Portworx-specific ServiceAccount object, such as the following:

  • autopilot
  • autopilot
  • px-csi
  • portworx-proxy
  • px-telemetry
  • stork
  • stork-scheduler

  For example:

  kind: ServiceAccount
  metadata:
    annotations:
      portworx.io/reconcile: "ignore"
  

  note

  If you've already upgraded to Operator version 25.3.0 and are affected by this issue, you can either downgrade to a previous Operator version or follow the workaround described above.

  To downgrade the Operator version, follow these steps to uninstall Operator version 25.3.0 and install 25.2.2:

  1. In the OpenShift web console, go to Operators > Installed Operators.

  2. Verify that the installed version of Portworx Enterprise is 25.3.0.

  3. Select Actions > Uninstall Operator.

  4. In the confirmation dialog, clear the Delete all operand instances for this operator check box. This ensures that Portworx continues to run after uninstallation of Operator.

     

  5. Select Uninstall again to confirm.

  6. After the uninstallation completes, return to OperatorHub.

  7. Search for Portworx Enterprise, and then install version 25.2.2.

     Ensure that you set the Update approval to manual while installing.

• PWX-45817: On Mirantis Kubernetes Engine (MKE) clusters, MKE injects tolerations into KVDB and Portworx pods. If you are using the ComponentK8sConfig custom resource (CR) to manage tolerations and the injected tolerations are not included in the CR, the Portworx Operator removes them. This causes the pods to restart continuously.

  Workaround: Follow the steps below:

  1. Ensure that jq or yq is installed on your machine.

  2. Get the kubeconfig of your cluster.

  3. Get taints on the cluster nodes:

  • For jq, run:

    kubectl --kubeconfig=<path/to/kubeconfig> get nodes -ojson | jq -r . | jq -r '.items[].spec.taints'
    

  • For yq, run:

    kubectl --kubeconfig=<path/to/kubeconfig> get nodes -oyaml | yq -r . | yq -r '.items[].spec.taints'
    

    Example output:

    null
    null
    null
    [{"effect": "NoSchedule", "key": "com.docker.ucp.manager"}]
    null
    null
    

  4. Apply the tolerations to the ComponentK8sConfig CR based on the command output in the previous step. For example:

     - componentNames:
         - KVDB
         - Storage
         - Portworx API
       workloadConfigs:
       - placement:
           tolerations:
           - key: com.docker.ucp.manager
             operator: Exists
         workloadNames:
         - storage
         - portworx-kvdb
         - portworx-api
     

• PWX-45960: When using the workload identity feature, restart of KVDB pods can cause the eks-pod-identity webhook to inject credentials into the KVDB pods because the same service account is used for the Portworx API, Portworx, and KVDB pods.

  Note: When credentials are removed from StorageCluster, the operator does not remove them from the KVDB pods if they have been added, so you must manually restart the KVDB pods to remove these credentials.

25.2.2​

July 8, 2025

Improvements​

Fixes​

25.2.1​

June 23, 2025

Fixes​

Known issues (Errata)​

25.2.0​

May 25, 2025

New features​

• Smart Upgrade now supports Kubernetes upgrades on additional platforms, expanding the streamlined and resilient upgrade process. Smart Upgrade maintains volume quorum and prevents application disruption during the parallel upgrade of Portworx and Kubernetes nodes.

  • Portworx upgrade: Smart Upgrade continues to be supported on all platforms.
  • Kubernetes upgrade: Smart Upgrade is now supported on the following platforms:
    • All OpenShift distributions
    • Google Anthos
    • Vanilla Kubernetes
    • Azure Kubernetes Service (AKS) (new)
    • Amazon Elastic Kubernetes Service (EKS) (new)
    • Google Kubernetes Engine (GKE) (new)

  For more information, see Smart Upgrade.

• Custom labels are supported on all Portworx managed components. You can apply labels to each component or component type via StorageCluster.spec.metadata.labels to improve observability. For more information, see StorageCluster.

Improvements​

Fixes​

Known issues (Errata)​

kubectl label nodes <node-name> px/enabled=false --overwrite

spec:
  placement:
    nodeAffinity:
      requiredDuringSchedulingIgnoredDuringExecution:
        nodeSelectorTerms:
        - matchExpressions:
          - key: px/enabled
            operator: In
            values:
              - "true"
              - "enabled"

Upgrade notes for OpenShift​

Portworx Operator version 25.1.0 has been replaced with 25.2.0. Upgrade to version 25.2.0.

Follow these steps to uninstall Operator version 25.1.0 and install version 25.2.0 on OpenShift clusters:

1. In the OpenShift web console, go to Operators > Installed Operators.

2. Verify that the installed version of Portworx Enterprise is 25.1.0.

3. Select Actions > Uninstall Operator.

4. In the confirmation dialog, clear the Delete all operand instances for this operator check box. This ensures that Portworx continues to run after uninstallation of Operator.

   

5. Select Uninstall again to confirm.

6. After the uninstallation completes, return to OperatorHub.

7. Search for Portworx Enterprise, and then install version 25.2.0.

25.1.0​​

May 21, 2025

This release has been replaced with version 25.2.0.

- key: node-role.kubernetes.io/infra
  operator: DoesNotExist

24.2.4​

April 17, 2025

Improvements​

24.2.3​

March 6, 2025

Improvements​

Fixes​

Known issues (Errata)​

• PWX-42235: When PX-Security is disabled in the StorageCluster, the operator initiates an upgrade to apply the change. During the upgrade, Portworx fails to mount secured persistent volumes (PVs), leading to VM live migration failures and blocking the upgrade.

  Workaround: Follow the steps below:

  1. Stop all pods consuming Portworx volumes before disabling security.
  2. Manually stop KubeVirt VMs before disabling security to prevent live migration failures.
  3. Restart the stopped VMs once all nodes have been successfully upgraded.

  Affected Versions: 24.2.3

  Severity: Minor

24.2.2​

February 3, 2025

Fixes​

24.2.1​

January 6, 2025

Improvements​

Bug Fixes​

24.2.0​

December 2, 2024

New features​

Portworx by Pure Storage is proud to introduce the following new features:

• Smart upgrade feature introduces a streamlined, resilient upgrade process for Portworx and Kubernetes nodes, allowing them to be upgraded in parallel while maintaining volume quorum and without application disruption.

  • Portworx upgrade: Smart upgrade is supported on all platforms.
  • Kubernetes upgrade: Smart upgrade is supported only on the following platforms:
    • All OpenShift Platforms
    • Google Anthos
    • Vanilla Kubernetes

• Health checks determines if the target system meets the requirements for Portworx before installation. It provides pass, fail, or warning notifications and assists you in resolving the issues right before the installation of Portworx.

Improvements​

Fixes​

Known issues (Errata)​

• PWX-39594: On MKE platforms, the Kubernetes cluster attempts to update the portworx-api and px-csi pods with tolerations that are not specified in the StorageCluster. As a result, the Portworx operator, which is unaware of these tolerations, tries to remove them. This results in a loop where the portworx-api and px-csi pods keep restarting.

  Workaround: Follow the steps below:

  1. Ensure that jq or yq installed on your machine.

  2. Get the kubeconfig of your cluster.

  3. Get taints on the cluster nodes.

     • For jq, run the kubectl --kubeconfig=<path/to/kubeconfig> get nodes -ojson | jq -r . | jq -r '.items[].spec.taints' command.

     • For yq, run the kubectl --kubeconfig=<path/to/kubeconfig> get nodes -oyaml | yq -r . | yq -r '.items[].spec.taints' command.

     The command output might look like the sample below:

     null
     null
     null
     [{"effect": "NoSchedule", "key": "com.docker.ucp.manager"}]
     null
     null
     

  4. Apply the tolerations to the StorageCluster based on the command output in the previous step.

     For example:

     spec:
       placement:
         tolerations:
         - key: com.docker.ucp.manager
           operator: Exists
     

  Affected Versions: 24.1.2 and 24.1.3

  Severity: Critical

24.1.3​

October 29, 2024

Fixes​

24.1.2​

October 11, 2024

Fixes​

24.1.1​

July 25, 2024

Improvements​

Fixes​

24.1.0​

June 11, 2024

Improvements​

Fixes​

23.10.5​

April 5, 2024

Improvement​

23.10.4​

March 19, 2024

Improvements​

Fixes​

Portworx by PureStorage has fixed the following issues in this release:

23.10.3​

February 08, 2024

Improvements​

Fixes​

Portworx by PureStorage has fixed the following issues in this release:

23.10.2​

January 23, 2024

Fixes​

Portworx by PureStorage has fixed the following issues in this release:

23.10.1​

November 22, 2023

Fixes​

23.10.0​

November 7, 2023

Improvements​

Fixes​

Known issues (Errata)​

23.7.0​

September 12, 2023

Notes​

• Enhanced Security: This release addresses security vulnerabilities to enhance overall security.

• Tech Preview: The OCP Dynamic Plugin for air-gapped installs is currently in tech preview.

• The Portworx Operator fully supports generic HTTP/HTTPS proxies. However, there is limited support for HTTPS proxies using SSL inspection, such as Next-Generation Firewalls that re-encrypt SSL traffic. To accommodate HTTPS proxy with SSL:

  • Portworx by PureStorage recommends configuring the Portworx StorageCluster, Portworx Operator, and License Server similarly to air-gapped environments.
  • For the Portworx StorageCluster, you can configure the proxy's self-signed Certification Authority (CA) certificate.
  note

  Telemetry connection to Pure1 with the Next-Generation Firewall is not supported.

Improvements​

Fixes​

23.5.1​

July 11, 2023

Fixes​

23.5.0​

June 13, 2023

Notes​

New features​

Portworx by Pure Storage is proud to introduce the following new features:

• OpenShift users on OCP 4.12 or newer and Portworx Enterprise 3.0.2 or newer versions can now enable the Console plugin option during Portworx Operator installation or upgrade to use the Portworx Cluster dashboard within the OpenShift UI to manage their Portworx cluster. This avoids switching and navigating between different management interfaces to perform Day 2 operations.
• The Portworx Operator now supports loading installation images into multiple custom registries for seamless Portworx installation for all Kubernetes installation environments (air gapped and non-air gapped). You need to update the path of the custom registry for each of these components in the version manifest prior to installation. For more information, see Install Portworx on Kubernetes with a custom container registry.

Improvements​

Fixes​

Known issues (Errata)​

23.4.1​

September 1, 2023

Fixes​

23.4.0​

May 03, 2023

Improvements​

Fixes​

23.3.1​

March 29, 2023

Improvements​

23.3.0​

March 22, 2023

Notes​

New features​

Portworx by Pure Storage is proud to introduce the following new features:

• telemetry is now enabled by default.

  • On fresh installations, all clusters will have telemetry enabled when you generate a spec from PX-Central.
  • When you upgrade the Portworx Operator to version 23.3.0, telemetry will be enabled by default unless you disable telemetry in the StorageCluster spec, or when the PX_HTTPS_PROXY variable is configured.
  note

  For air-gapped clusters, you must disable telemetry explicitly during spec generation. To learn how to disable telemetry, see the air-gapped installation section. If you do not disable telemetry, telemetry pods will remain in the init state as Portworx fails to reach the Pure1 telemetry endpoint. This does not impact Portworx pods.

• The StorageCluster spec for configuring Prometheus now contains the following new fields:

  • spec.Monitoring.Prometheus.Resources: Provides the ability to configure Prometheus resource usage, such as memory and CPU usage. If the resources field is not configured, default limits will be set to CPU 1, memory 800M, and ephemeral storage 5G.
  • spec.Monitoring.Prometheus.securityContext.runAsNonRootin: Provides the ability to configure the Prometheus service type, and the default value is set to true.

• Added a new environment variable KUBELET_DIR. This variable can be used to specify a custom kubelet directory path.

• Added an annotation portworx.io/scc-priority to the StorageCluster spec for configuring the priority of Portworx security context constraints (SCC).

Improvements​

Fixes​

1.10.5​

March 07, 2023

Updates​

• Added the newspec.updatestrategy.rollingupdate.minreadyseconds flag. During rolling updates, this flag will wait for all pods to be ready for at least minReadySeconds before updating the next batch of pods, where the size of the pod batch is specified through the spec.updateStrategy.rollingUpdate.maxUnavailable flag.

1.10.4​

February 22, 2023

Updates​

• Added a new annotation portworx.io/is-oke=true to the StorageCluster spec to support Portworx deployment on the Oracle Container Engine for Kubernetes (OKE) cluster.

Fixes​

• Fixed a bug where the Portworx PVC controller leader election resources conflicted with the resources used by the Kubernetes controller manager.
• Fixed the Anthos Telemetry installation failure. Operator now allows two sidecar containers to run on the same node.

1.10.3​

January 27, 2023

Fixes​

• An issue with a missing node name in the Portworx pod template in Operator version 1.10.2 sometimes scheduled the Portworx pod on a random node. This node name is no longer missing, and Portworx is now scheduled correctly.

1.10.2​

January 24, 2023

Updates​

• Stork now uses KubeSchedulerConfiguration for Kubernetes version 1.23 or newer, so that pods are evenly distributed across all nodes in your cluster.

1.10.1​

Dec 5, 2022

Updates​

• Added support for Kubernetes version 1.25, which includes:
  • Removed PodSecurityPolicy when deploying Portworx with Operator.
  • Upgraded the API version of PodDisruptionBudget from policy/v1beta1 to policy/v1
• Added a UI option in the spec generator to configure Kubernetes version when you choose to deploy Portworx version 2.12.
• The Portworx Operator is now deployed without verbose log by default. To enable it, add the --verbose argument to the operator deployment.
• For CSI deployment, the px-csi-ext pods now set Stork as a scheduler in the px-csi-ext deployment spec.
• The operator now chooses maxStorageNodesPerZone’s default value to efficiently manage the number of storage nodes in a cluster. For more details, see Manage the number of storage nodes.

1.10.0​

Oct 24, 2022

Notes​

Updates​

• Pure1 integration has been re-architected to be more robust and use less memory. It is supported on Portworx version 2.12 clusters deployed with Operator version 1.10.
• To reduce memory usage, added a new argument disable-cache-for to disable Kubernetes objects from controller runtime cache. For example,--disable-cache-for="Event,ConfigMap,Pod,PersistentVolume,PersistentVolumeClaim".
• Operator now blocks Portworx installation if Portworx is uninstalled without a wipe and then reinstalled with a different name.
• For a new installation, Operator now sets the max number of storage nodes per zone, so that the 3 storage nodes in the entire cluster are uniformly spread across zones.

Fixes​

• Fixed a bug where DaemonSet migration was failing if the Portworx cluster ID was too long.

1.9.1​

Sep 8, 2022

Updates​

• Added support for Kubernetes version 1.24:
  • Added docker.io prefix for component images deployed by Operator.
  • To determine Kubernetes master nodes, Operator now uses the control-plane node role instead of master.

Fixes​

• In Operator 1.9.0, when you enabled the CSI snapshot controller explicitly in the StorageCluster, the csi-snapshot-controller sidecar containers might have been removed during an upgrade or restart operation. This issue is fixed in Operator 1.9.1.

1.9.0​

Aug 1, 2022

Updates​

• Daemonset to Operator migration is now Generally Available. This includes the following features:
• The ability to perform a dry run of the migration
• Migration for generic helm chart from Daemonset to the Portworx Operator
• Support for the OnDelete migration strategy
• Support for various configurations such as external KVDB, custom volumes, environment variables, service type, and annotations
• You can now use the generic helm chart to install Portworx with the Portworx Operator. Note: Only AWS EKS has been validated for cloud deployments.
• Support for enabling pprof in order to get Portworx Operator container profiles for memory, CPU, and so on.
• The operator now creates example CSI storage classes.
• The operator now enables the CSI snapshot controller by default on Kubernetes 1.17 and newer.

Fixes​

• Fixed an issue where KVDB pods were repeatedly created when a pod was in the evicted or outOfPods status.

Known issues (Errata)​

• When you upgrade Operator to version 1.9.0, the snapshot controller containers are removed from px-csi-ext deployment when the installSnapshotController flag is set to true explicitly in the StorageCluster spec.
  Workaround: To fix this issue, either restart Operator or upgrade to a newer version.

1.8.1​

June 22, 2022

Updates​

• Added support for Operator to run on IPv6 environment.
• You can now enable CSI topology feature by setting the .Spec.CSI.Topology.Enabled flag to true in the StorageCluster CRD, the default value is false. The feature is only supported on FlashArray direct access volumes.
• Operator now uses custom SecurityContextConstraints portworx instead of privileged on OpenShift.
• You can now add custom annotations to any service created by Operator.
• You can now configure ServiceType on any service created by Operator.

Fixes​

• Fixed pod recreation race condition during OCP upgrade by introducing exponential back-off to pod recreation when the operator.libopenstorage.org/cordoned-restart-delay-secs annotation is not set.
• Fixed the incorrect CSI provisioner arguments when custom image registry path contains ":".

1.8.0​

Apr 14, 2022

Updates​

• Daemonset to operator migration is in Beta release.
• Added support for passing custom labels to Portworx API service from StorageCluster.
• Operator now enables the Autopilot component to communicate securely using tokens when PX-Security is enabled in the Portworx cluster.
• Added field preserveFullCustomImageRegistry in StorageCluster spec to preserve full image path when using custom image registry.
• Operator now retrieves the version manifest through proxy if PX_HTTP_PROXY is configured.
• Stork, Stork scheduler, CSI, and PVC controller pods are now deployed with topologySpreadConstraints to distribute pod replicas across Kubernetes failure domains.
• Added support for installing health monitoring sidecars from StorageCluster.
• Added support for installing snapshot controller and CRD from StorageCluster.
• The feature gate for CSI is now deprecated and replaced by setting spec.csi.enabled in StorageCluster.
• Added support to enable hostPID to Portworx pods using the annotation portworx.io/host-pid="true" in StorageCluster.
• Operator now sets fsGroupPolicy in the CSIDriver object to File. Previously it was not set explicitly, and the default value was ReadWriteOnceWithFsType.
• Added skip-resource annotation to PX-Security Kubernetes secrets to skip backing them to the cloud.
• Operator now sets the dnsPolicy of Portworx pod to ClusterFirstWithHostNet by default.
• When using Cloud Storage, Operator validates that the node groups in StorageCluster use only one common label selector key across all node groups. It also validates that the value matches spec.cloudStorage.nodePoolLabel if a is present. If the value is not present, it automatically populates it with the value of the common label selector.

Fixes​

• Fixed Pod Disruption Budget issue blocking Openshift upgrade on Metro DR setup.
• Fixed Stork scheduler's pod anti-affinity by adding the label name: stork-scheduler to Stork scheduler deployments.
• When a node level spec specifies a cloud storage configuration, we no longer set the cluster level default storage configuration. Before this fix, the node level cloud storage configuration would be overwritten.