Upgrading Longhorn: 1.7.x to 1.9.x for Encryption Support

Overview

This article upgrades Longhorn from 1.7.x to 1.9.x through the required intermediate version 1.8.x. The upgrade fixes a bug where volume encryption fails on Talos 1.9+ due to cryptsetup receiving -d /dev/stdin instead of -d -¹.

Before You Begin

Prerequisites

• Longhorn Hardening completed

Why Sequential Upgrades

Longhorn only supports upgrading one minor version at a time². Skipping versions (e.g., 1.7.x directly to 1.9.x) is not supported.

Upgrade path: 1.7.x → 1.8.x → 1.9.x

Version Requirements

Check your Kubernetes version:

kubectl version

Upgrade to 1.8.x

HelmRelease: Upgrade to 1.8.1

k8s/core/longhorn/helmrelease.yaml:

# ... existing header ...
spec:
    interval: 1h
    chart:
        spec:
            chart: longhorn
            version: "1.8.1" # CHANGE from "1.7.3"
            sourceRef:
                kind: HelmRepository
                name: longhorn
                namespace: flux-system
    # ... existing install, upgrade, values ...

Git: Commit 1.8 Upgrade

git add k8s/core/longhorn/helmrelease.yaml
git commit -m "feat(longhorn): upgrade to 1.8.1"
git push

Flux: Sync 1.8 Upgrade

flux reconcile source git flux-system
flux reconcile kustomization sync

Verify: 1.8 Installation

Watch pods restart with the new version:

kubectl get pods -n longhorn-system -w

Expected: All pods eventually reach Running state. The upgrade takes 2-3 minutes as components roll out.

Verify the version:

kubectl get helmrelease -n longhorn-system longhorn -o jsonpath='{.spec.chart.spec.version}'

Expected: 1.8.1

Upgrade to 1.9.x

HelmRelease: Upgrade to 1.9.2

k8s/core/longhorn/helmrelease.yaml:

# ... existing header ...
spec:
    interval: 1h
    chart:
        spec:
            chart: longhorn
            version: "1.9.2" # CHANGE from "1.8.1"
            sourceRef:
                kind: HelmRepository
                name: longhorn
                namespace: flux-system
    # ... existing install, upgrade, values ...

Git: Commit 1.9 Upgrade

git add k8s/core/longhorn/helmrelease.yaml
git commit -m "feat(longhorn): upgrade to 1.9.2"
git push

Flux: Sync 1.9 Upgrade

flux reconcile source git flux-system
flux reconcile kustomization sync

Verify: 1.9 Installation

Watch pods restart:

kubectl get pods -n longhorn-system -w

Expected: All pods eventually reach Running state.

Verify the version:

kubectl get helmrelease -n longhorn-system longhorn -o jsonpath='{.spec.chart.spec.version}'

Expected: 1.9.2

Next Steps

With Longhorn upgraded to 1.9.x, encrypted volumes now work on Talos 1.9+. Continue with application hardening.

See: Minecraft Hardening

Resources