- ceph-users - lists.ceph.io

Re: [Ceph tentacle 20.2.2] problem with nfs ganesha and nfsv3
by Frédéric Nass 09 Aug '26

09 Aug '26

Ok so here's the clarification: First of all, by "dropping NFSv3 support (by default)" I didn't mean that NFSv3 wouldn't be supported anymore, but that it would be disabled by default and would need to be explicitly enabled in the service specs. Also, this is not a future change, it already happened. v20.2.3 ships PR #70675, so upgrading to v20.2.3 silently disables NFSv3. The related PRs were merged shortly before the tag was cut and are missing from the v20.2.3 release notes and changelog, so there is currently no warning anywhere. We should fix that. Users who need NFSv3 must now explicitly enable it by adding 'enable_nfsv3: true' to the NFS service spec. Since older MGRs reject this field, it can only be applied once MGRs run v20.2.3. The cleanest path is a staggered upgrade to avoid redeploying the NFS service twice: 1. ceph orch upgrade start --image <v20.2.3> --daemon-types mgr 2. add 'enable_nfsv3: true' to the NFS service spec and re-apply it 3. run the upgrade as usual (already upgraded MGRs will be skipped) Users who have already upgraded should simply update the spec and re-apply it to get NFSv3 back. @Wodel Ultimately, upgrading to v20.2.3 should address your original concern. Best regards, Frédéric. -- Frédéric Nass Ceph Ambassador France | Senior Ceph Engineer @ CLYSO Le sam. 8 août 2026, 02:36, Frédéric Nass via ceph-users <ceph-users(a)ceph.io> a écrit : > Hi Robert, > > Tentacle should soon be dropping NFSv3 support (by default) as per > https://github.com/ceph/ceph/pull/70675. My understanding so far is that > users will have to add 'enable_nfsv3: true' in the NFS service specs to > keep using NFSv3. I hope that can soon be clarified in the PR and Tentacle > documentation. > > Cheers, > Frédéric > > -- > Frédéric Nass > > Ceph Ambassador France | Senior Ceph Engineer @ CLYSO > > > Frédéric Nass > > Senior Ceph Engineer > > Ceph Ambassador, France > > +49 89 215252-751 <https://call.ctrlq.org/+49%2089%20215252-751> > > frederic.nass(a)clyso.com > > www.clyso.com > > Hohenzollernstr. 27, 80801 Munich > <https://www.google.com/maps/search/Hohenzollernstr.+27,+80801+Munich?entry=…> > > Utting a. A. | HR: Augsburg | HRB: 25866 | USt. ID-Nr.: DE2754306 > > > Le ven. 7 août 2026, 18:07, Robert Sander via ceph-users < > ceph-users(a)ceph.io> > a écrit : > > > Hi, > > > > Am 07.08.26 um 10:59 AM schrieb Frédéric Nass via ceph-users: > > > > > Or, if that's too much of a maintenance burden and you're worried > you'll > > > forget that step, just install rpcbind on the NFS nodes and leave NFSv3 > > > enabled. > > > > Or maybe NFSv3 is made an option for the NFS service spec with the hint > > that then rpcbind has to be installed. > > > > Or the orchestrator installs rpcbind when the NFS service should offer > > NFSv3. > > > > Regards > > -- > > Robert Sander > > Linux Consultant > > > > Heinlein Consulting GmbH > > Schwedter Str. 8/9b, 10119 Berlin > > > > https://www.heinlein-support.de > > > > Tel: +49 30 405051 - 0 > > Fax: +49 30 405051 - 19 > > > > Amtsgericht Berlin-Charlottenburg - HRB 220009 B > > Geschäftsführer: Peer Heinlein - Sitz: Berlin > > _______________________________________________ > > ceph-users mailing list -- ceph-users(a)ceph.io > > To unsubscribe send an email to ceph-users-leave(a)ceph.io > > > _______________________________________________ > ceph-users mailing list -- ceph-users(a)ceph.io > To unsubscribe send an email to ceph-users-leave(a)ceph.io > Frédéric Nass Senior Ceph Engineer Ceph Ambassador, France +49 89 215252-751 <https://call.ctrlq.org/+49%2089%20215252-751> frederic.nass(a)clyso.com www.clyso.com Hohenzollernstr. 27, 80801 Munich Utting a. A. | HR: Augsburg | HRB: 25866 | USt. ID-Nr.: DE2754306

1 0

Re: Ceph Tentacle 20.2.3 Noble Support
by Tarrago, Eli (RIS-BCT) 07 Aug '26

07 Aug '26

Hello Anthony, 1. Our Ceph infrastructure was provisioned by ceph-ansible and utilizes package installation 2. Our Openstack deployment has hypervisors that use packages installed to the hypervisors to allow connectivity between hypervisor and cluster. 3. 20.2.2 Shipped with Noble support, but 20.2.3 did not. It appeared to be an oversight that I wanted to raise. I checked the change logs for the 20.2.3 which made no mention of depreciating the Noble package. As such, I raised it as a potential issue. Thanks, Eli Tarrago From: Anthony D'Atri via ceph-users <ceph-users(a)ceph.io> Date: Friday, August 7, 2026 at 3:20 PM To: Tarrago, Eli (RIS-BCT) <Eli.Tarrago(a)lexisnexisrisk.com> Cc: Anthony Middleton via ceph-users <ceph-users(a)ceph.io> Subject: [ceph-users] Re: Ceph Tentacle 20.2.3 Noble Support ⚠ External email If the sender is unfamiliar, check home.relx.com → Trusted partners to verify them. Why do you care about packages? > On Aug 7, 2026, at 10:10 AM, Tarrago, Eli (RIS-BCT) via ceph-users <ceph-users(a)ceph.io> wrote: > > Good Afternoon Ceph Users, > > I recently became aware of a discrepancy that I wanted to raise: > > https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdownload.…<https://download.ceph.com/debian-20.2.2/dists/> > > Providers Ubuntu Noble packages, > > Where as, > > https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdownload.…<https://download.ceph.com/debian-20.2.3/dists/> > > Does not. Sorry it’s Friday and to bring this up with you. I hope noble support can be returned to latest package release. > > Thank you > > Eli Tarrago > > ________________________________ > The information contained in this e-mail message is intended only for the personal and confidential use of the recipient(s) named above. This message may be an attorney-client communication and/or work product and as such is privileged and confidential. If the reader of this message is not the intended recipient or an agent responsible for delivering it to the intended recipient, you are hereby notified that you have received this document in error and that any review, dissemination, distribution, or copying of this message is strictly prohibited. If you have received this communication in error, please notify us immediately by e-mail, and delete the original message. > _______________________________________________ > ceph-users mailing list -- ceph-users(a)ceph.io > To unsubscribe send an email to ceph-users-leave(a)ceph.io _______________________________________________ ceph-users mailing list -- ceph-users(a)ceph.io To unsubscribe send an email to ceph-users-leave(a)ceph.io ________________________________ The information contained in this e-mail message is intended only for the personal and confidential use of the recipient(s) named above. This message may be an attorney-client communication and/or work product and as such is privileged and confidential. If the reader of this message is not the intended recipient or an agent responsible for delivering it to the intended recipient, you are hereby notified that you have received this document in error and that any review, dissemination, distribution, or copying of this message is strictly prohibited. If you have received this communication in error, please notify us immediately by e-mail, and delete the original message.

1 0

Re: Ceph Tentacle 20.2.3 Noble Support
by Anthony D'Atri 07 Aug '26

07 Aug '26

Why do you care about packages? > On Aug 7, 2026, at 10:10 AM, Tarrago, Eli (RIS-BCT) via ceph-users <ceph-users(a)ceph.io> wrote: > > Good Afternoon Ceph Users, > > I recently became aware of a discrepancy that I wanted to raise: > > https://download.ceph.com/debian-20.2.2/dists/ > > Providers Ubuntu Noble packages, > > Where as, > > https://download.ceph.com/debian-20.2.3/dists/ > > Does not. Sorry it’s Friday and to bring this up with you. I hope noble support can be returned to latest package release. > > Thank you > > Eli Tarrago > > ________________________________ > The information contained in this e-mail message is intended only for the personal and confidential use of the recipient(s) named above. This message may be an attorney-client communication and/or work product and as such is privileged and confidential. If the reader of this message is not the intended recipient or an agent responsible for delivering it to the intended recipient, you are hereby notified that you have received this document in error and that any review, dissemination, distribution, or copying of this message is strictly prohibited. If you have received this communication in error, please notify us immediately by e-mail, and delete the original message. > _______________________________________________ > ceph-users mailing list -- ceph-users(a)ceph.io > To unsubscribe send an email to ceph-users-leave(a)ceph.io

1 0

Re: Ceph Tentacle 20.2.3 Noble Support
by Yuri Weinstein 07 Aug '26

07 Aug '26

Hi Eli Thank you for your email. Noble was never part of the official tentacle distro support matrix (jammy, centos9, rocky10, bookworm, windows) — it appeared in the 20.2.1 and 20.2.2 builds outside that matrix, which was the actual discrepancy. 20.2.3 reflects the correct, intended matrix, so we won't be rebuilding noble for it. We plan to add Noble support to Tentacle this Fall. We'll clarify this in the release docs going forward to avoid confusion like this. Regards On Fri, Aug 7, 2026 at 10:10 AM Tarrago, Eli (RIS-BCT) via ceph-users < ceph-users(a)ceph.io> wrote: > Good Afternoon Ceph Users, > > I recently became aware of a discrepancy that I wanted to raise: > > https://download.ceph.com/debian-20.2.2/dists/ > > Providers Ubuntu Noble packages, > > Where as, > > https://download.ceph.com/debian-20.2.3/dists/ > > Does not. Sorry it’s Friday and to bring this up with you. I hope noble > support can be returned to latest package release. > > Thank you > > Eli Tarrago > > ________________________________ > The information contained in this e-mail message is intended only for the > personal and confidential use of the recipient(s) named above. This message > may be an attorney-client communication and/or work product and as such is > privileged and confidential. If the reader of this message is not the > intended recipient or an agent responsible for delivering it to the > intended recipient, you are hereby notified that you have received this > document in error and that any review, dissemination, distribution, or > copying of this message is strictly prohibited. If you have received this > communication in error, please notify us immediately by e-mail, and delete > the original message. > _______________________________________________ > ceph-users mailing list -- ceph-users(a)ceph.io > To unsubscribe send an email to ceph-users-leave(a)ceph.io > >

1 0

Re: [Ceph tentacle 20.2.2] problem with nfs ganesha and nfsv3
by Frédéric Nass 07 Aug '26

07 Aug '26

Hi Robert, Tentacle should soon be dropping NFSv3 support (by default) as per https://github.com/ceph/ceph/pull/70675. My understanding so far is that users will have to add 'enable_nfsv3: true' in the NFS service specs to keep using NFSv3. I hope that can soon be clarified in the PR and Tentacle documentation. Cheers, Frédéric -- Frédéric Nass Ceph Ambassador France | Senior Ceph Engineer @ CLYSO Frédéric Nass Senior Ceph Engineer Ceph Ambassador, France +49 89 215252-751 <https://call.ctrlq.org/+49%2089%20215252-751> frederic.nass(a)clyso.com www.clyso.com Hohenzollernstr. 27, 80801 Munich Utting a. A. | HR: Augsburg | HRB: 25866 | USt. ID-Nr.: DE2754306 Le ven. 7 août 2026, 18:07, Robert Sander via ceph-users <ceph-users(a)ceph.io> a écrit : > Hi, > > Am 07.08.26 um 10:59 AM schrieb Frédéric Nass via ceph-users: > > > Or, if that's too much of a maintenance burden and you're worried you'll > > forget that step, just install rpcbind on the NFS nodes and leave NFSv3 > > enabled. > > Or maybe NFSv3 is made an option for the NFS service spec with the hint > that then rpcbind has to be installed. > > Or the orchestrator installs rpcbind when the NFS service should offer > NFSv3. > > Regards > -- > Robert Sander > Linux Consultant > > Heinlein Consulting GmbH > Schwedter Str. 8/9b, 10119 Berlin > > https://www.heinlein-support.de > > Tel: +49 30 405051 - 0 > Fax: +49 30 405051 - 19 > > Amtsgericht Berlin-Charlottenburg - HRB 220009 B > Geschäftsführer: Peer Heinlein - Sitz: Berlin > _______________________________________________ > ceph-users mailing list -- ceph-users(a)ceph.io > To unsubscribe send an email to ceph-users-leave(a)ceph.io >

1 0

Re: [Ceph-maintainers] Re: Re: v20.2.3 Tentacle released
by Afreen 07 Aug '26

07 Aug '26

On Fri, Aug 7, 2026 at 6:44 PM Salatiel Filho via Ceph-maintainers < ceph-maintainers(a)ceph.io> wrote: > What exactly do you mean by CephFS cloning ? This cluster is used > exclusively to provide RWX volumes to a k8s using cephcsi. Velero does > backup though and creates volume snapshots , but I am not sure if > that's what you mean. > Any commands I can run to confirm if cloning is being used ? > [Afreen] Yes that confirms then . So this bugs is being fixed and it only happens with cephfs subvolums die to a wrong format internally used https://tracker.ceph.com/issues/75619 > "ceph progress clear" did the trick to load the pools page in the > dashboard, but you said: "Its just clears the display events and does > not stop operations." > What operations are still running ? post-upgrade operations? why? > Will them eventually finish ? > [Afreen] What I meant was that running that command was not harmful. And good to know it worked for you. Thanks > > Thanks! > > Atenciosamente/Kind regards, > Salatiel > > On Thu, Aug 6, 2026 at 8:31 PM Afreen <afreen23.git(a)gmail.com> wrote: > > > > Hey, > > > > That seems like some issue in parsing the format and so far what we > found out is that it could happen when CephFS cloning is used , are you > using that ? > > And pools page is failing because its polling /summary API - fetching > progress internally. > > > > You can try clearing progress and then refresh - "ceph progress clear". > Its just clears the display events and does not stop operations. > > > > - Afreen > > > > On Thu, Aug 6, 2026 at 6:42 PM Salatiel Filho via ceph-users < > ceph-users(a)ceph.io> wrote: > >> > >> After upgrading from 20.2.2 to 20.2.3, the dashboard is partially > >> broken. List pools don't work. Error 500. > >> Also get error 500 popup as soon as I login to the dashboard. > >> > >> Logs show this: > >> 2026-08-06 10:04:23 2026-08-06T13:04:23.386+0000 7f5afcd91640 0 > >> [dashboard ERROR dashboard.services.exception] Internal Server Error > >> 2026-08-06 10:04:23 Traceback (most recent call last): > >> 2026-08-06 10:04:23 File > >> "/usr/share/ceph/mgr/dashboard/services/exception.py", line 47, in > >> dashboard_exception_handler > >> 2026-08-06 10:04:23 return handler(*args, **kwargs) > >> 2026-08-06 10:04:23 File > >> "/lib/python3.9/site-packages/cherrypy/_cpdispatch.py", line 54, in > >> __call__ > >> 2026-08-06 10:04:23 return self.callable(*self.args, > **self.kwargs) > >> 2026-08-06 10:04:23 File > >> "/usr/share/ceph/mgr/dashboard/controllers/_base_controller.py", line > >> 264, in inner > >> 2026-08-06 10:04:23 ret = func(*args, **kwargs) > >> 2026-08-06 10:04:23 File > >> "/usr/share/ceph/mgr/dashboard/controllers/summary.py", line 105, in > >> __call__ > >> 2026-08-06 10:04:23 e, f = progress.get_progress_tasks() > >> 2026-08-06 10:04:23 File > >> "/usr/share/ceph/mgr/dashboard/services/progress.py", line 89, in > >> get_progress_tasks > >> 2026-08-06 10:04:23 > >> finished_t.append(_progress_event_to_dashboard_task(ev, True)) > >> 2026-08-06 10:04:23 File > >> "/usr/share/ceph/mgr/dashboard/services/progress.py", line 60, in > >> _progress_event_to_dashboard_task > >> 2026-08-06 10:04:23 > _progress_event_to_dashboard_task_common(event, task) > >> 2026-08-06 10:04:23 File > >> "/usr/share/ceph/mgr/dashboard/services/progress.py", line 52, in > >> _progress_event_to_dashboard_task_common > >> 2026-08-06 10:04:23 'metadata': dict(event.get('refs', {})), > >> 2026-08-06 10:04:23 ValueError: dictionary update sequence element > >> #0 has length 3; 2 is required > >> 2026-08-06 10:04:23 2026-08-06T13:04:23.390+0000 7f5afcd91640 0 > >> [dashboard ERROR dashboard.tools] [::ffff:10.175.143.9:53998] [GET] > >> [500] [0.009s] [admin] [513.0B] /api/summary > >> 2026-08-06 10:04:23 2026-08-06T13:04:23.390+0000 7f5afcd91640 0 > >> [dashboard ERROR dashboard.tools] [b'{"status": "500 Internal Server > >> Error", "detail": "The server encountered an unexpected condition > >> which prevented it from fulfilling the request.", "request_id": > >> "c7349113-44d8-4e48-88d6-3a469786397f"} > >> > >> > >> > >> '] > >> 2026-08-06 10:04:23 2026-08-06T13:04:23.494+0000 7f5afed95640 0 > >> [dashboard ERROR dashboard.controllers.frontend_logging] > >> (https://ceph.mydomain/#/pool) Http failure response for > >> https://ceph.mydomain/api/summary: 500 Internal Server Error > >> > >> Atenciosamente/Kind regards, > >> Salatiel > >> > >> On Wed, Aug 5, 2026 at 11:06 AM Yuri Weinstein via ceph-users > >> <ceph-users(a)ceph.io> wrote: > >> > > >> > This is the third minor release in the Tentacle series. > >> > We recommend that all users update to this release. > >> > > >> > Notable Changes > >> > --------------- > >> > > >> > MDS (Metadata Server) > >> > --------------------- > >> > > >> > * Fixed a crash and shutdown hang that could occur when ephemeral > pins were > >> > active and max_mds was set to 0. > >> > * Session reclaim could miss blocklisting an old session; this is now > >> > handled correctly. > >> > * Fixed a case where scrub was unable to identify damage from an > >> > irreparable hard link. > >> > > >> > OSD (Object Storage Daemon) > >> > ---------------------------- > >> > > >> > * BlueStore: Fixed a BlueFS WAL envelope-mode bug that caused write > buffer > >> > misalignment. > >> > * Erasure Coding: Fixed truncate+write planning for EC shard sizes. > >> > * Fixed a condition that prevented rolling forward of PG log entries. > >> > * Prevented OSDMap::check_health() from asserting when new OSDs are > found > >> > in a subtree. > >> > * Scrub: "repairing" scrubs are now allowed at all times. > >> > > >> > RGW (RADOS Gateway) > >> > -------------------- > >> > > >> > * Added the ssl_ciphersuites option for the Beast front-end to > support TLS > >> > 1.3 cipher customization. > >> > * Fixed PutObject's canned_acl comparison bug affecting > BlockPublicAcls. > >> > * Fixed crashes occurring on realm reload. > >> > * Implemented CopyObject support for encrypted objects. > >> > * Added mTLS client-certificate authentication support for Kafka > >> > notifications. > >> > * Fixed removal of delete markers in lifecycle processing. > >> > > >> > RADOS / librados / neorados > >> > ---------------------------- > >> > > >> > * neorados: Fixed an infinite trim loop on empty data log shards. > >> > * Fixed cancellation-slot cleanup in librados/asio's associated > executor. > >> > > >> > Dashboard > >> > ----------------- > >> > > >> > * Added a hardware-monitoring dashboard backed by node-proxy metrics. > >> > * Fixed a bind-address regression caused by CherryPy isolation. > >> > * Added support for adding hosts via CSV upload. > >> > * NVMeoF: multiple CLI and UI backports (EC pool support, IO > statistics, > >> > role management). > >> > * Object: The global RGW Roles tab has been removed. Role management > is now > >> > scoped under RGW Accounts, where roles can be listed, created, > edited, and > >> > deleted for a selected account. > >> > > >> > ceph-volume > >> > ----------- > >> > > >> > * Reworked OSD mapper lifecycle handling (LVM + raw) for activate. > >> > * Improved detection of rotational media under dm-crypt to bypass the > >> > workqueue correctly. > >> > * Fixed OSD re-deployment issues with disk-selection filters and DB > devices. > >> > * Added retry handling for lvs when it returns an empty result or a > >> > "devices file is missing" error. > >> > > >> > NVMe-oF > >> > ------- > >> > > >> > * Added configurable delayed failback (default 0, no delay) to > accommodate > >> > initiators that recover paths with a delay. > >> > * Gateways in the DELETING state now ignore beacons and send empty > maps > >> > instead of processing them. > >> > * rbd_with_crc32c is now enabled by default via cephadm. > >> > * Introduced a new NVMeoF mgr module. The module automatically > creates the > >> > ".nvmeof" metadata pool if it does not already exist. Gateway-group > state > >> > files are stored in this pool unless the user specifies another pool. > The > >> > module is enabled automatically on fresh installs; on upgrades from an > >> > older cluster, it must be enabled manually. > >> > > >> > RBD > >> > --- > >> > > >> > * Fixed a use-after-free bug releasing object map locks during deep > copy. > >> > * Fixed memory leaks in PWL discard operations. > >> > * Obsolete primary mirror snapshots are now pruned after relocation. > >> > > >> > We recommend users to update to this release. > >> > For detailed release notes with links & changelog please refer to the > >> > official blog entry at > >> > https://ceph.io/en/news/blog/2026/v20-2-3-tentacle-released/ > >> > > >> > Getting Ceph > >> > ------------ > >> > * Git at git://github.com/ceph/ceph.git > >> > * Tarball at https://download.ceph.com/tarballs/ceph-20.2.3.tar.gz > >> > * Containers at https://quay.io/repository/ceph/ceph > >> > * For packages, see > https://docs.ceph.com/en/latest/install/get-packages/ > >> > * Release git sha1: 06c2f9c35b67055a8a6fb99d1be236b3c4832ace > >> > _______________________________________________ > >> > ceph-users mailing list -- ceph-users(a)ceph.io > >> > To unsubscribe send an email to ceph-users-leave(a)ceph.io > >> _______________________________________________ > >> ceph-users mailing list -- ceph-users(a)ceph.io > >> To unsubscribe send an email to ceph-users-leave(a)ceph.io > _______________________________________________ > Ceph-maintainers mailing list -- ceph-maintainers(a)ceph.io > To unsubscribe send an email to ceph-maintainers-leave(a)ceph.io >

1 1

Ceph Tentacle 20.2.3 Noble Support
by Tarrago, Eli (RIS-BCT) 07 Aug '26

07 Aug '26

Good Afternoon Ceph Users, I recently became aware of a discrepancy that I wanted to raise: https://download.ceph.com/debian-20.2.2/dists/ Providers Ubuntu Noble packages, Where as, https://download.ceph.com/debian-20.2.3/dists/ Does not. Sorry it’s Friday and to bring this up with you. I hope noble support can be returned to latest package release. Thank you Eli Tarrago ________________________________ The information contained in this e-mail message is intended only for the personal and confidential use of the recipient(s) named above. This message may be an attorney-client communication and/or work product and as such is privileged and confidential. If the reader of this message is not the intended recipient or an agent responsible for delivering it to the intended recipient, you are hereby notified that you have received this document in error and that any review, dissemination, distribution, or copying of this message is strictly prohibited. If you have received this communication in error, please notify us immediately by e-mail, and delete the original message.

1 0

New mailing list offered for Ceph job postings
by Patrick Donnelly 07 Aug '26

07 Aug '26

Greetings, A new mailing list is now available for job postings relating to Ceph: https://lists.ceph.io/postorius/lists/careers.ceph.io/ Please subscribe if you want to keep up with job offerings available from employers or would like to post jobs to the list. -- Patrick Donnelly, Ph.D. He / Him / His Red Hat Partner Engineer IBM, Inc. GPG: 19F28A586F808C2402351B93C3301A3E258DD79D

1 0

Re: Grafana certificate in version 19
by Robert Sander 07 Aug '26

07 Aug '26

Hi, Am 07.08.26 um 3:34 PM schrieb Eugen Block via ceph-users: > > what I noted in my "best practices" doc is this article from RH how to > convert to json format: > > https://access.redhat.com/solutions/7109138 Thanks. This links to https://github.com/rkachach/utils which seems to be a personal repo from Redouane Kachach who also talked about the certmgr in London: https://www.youtube.com/watch?v=AbjZD0pYwxc https://ceph.io/assets/pdfs/events/2026/ceph-days-london/management-in-ceph… So it seems to be valid. But come on guys, please update the documentation. Regards -- Robert Sander Linux Consultant Heinlein Consulting GmbH Schwedter Str. 8/9b, 10119 Berlin https://www.heinlein-support.de Tel: +49 30 405051 - 0 Fax: +49 30 405051 - 19 Amtsgericht Berlin-Charlottenburg - HRB 220009 B Geschäftsführer: Peer Heinlein - Sitz: Berlin

1 0

Re: Grafana certificate in version 19
by Chris Palmer 07 Aug '26

07 Aug '26

Trying again as something completely reformatted my commands.... I never got to the bottom of this, on either squid or tentacle. I have an externally-generated cert/key. As a workaround I do this after each upgrade (most recently to 20.2.3): cp ~/my_grafana_cert.key /var/lib/ceph/`ceph fsid`/grafana.`hostname -s`/etc/grafana/certs/cert_key cp ~/my_grafana_cert.crt /var/lib/ceph/`ceph fsid`/grafana.`hostname -s`/etc/grafana/certs/cert_file ceph orch daemon restart grafana.`hostname -s` --force It would be nice to know what the right way is. Regards, Chris On 07/08/2026 13:51, Robert Sander via ceph-users wrote: > Hi, > > how do I set the grafana certificate and key in Ceph 19 that is used on > port 3000? > > The documentation on > https://docs.ceph.com/en/squid/cephadm/services/monitoring/#configuring-ssl… > states: > > # ceph config-key set mgr/cephadm/{hostname}/grafana_key -i $PWD/key.pem > # ceph config-key set mgr/cephadm/{hostname}/grafana_crt -i > $PWD/certificate.pem > # ceph orch reconfig grafana > > But after doing that grafana still serves a self-signed certificate with > the common name containing the hostname of the first MON (which is not > correct). > > Digging into "ceph config-key dump" shows two entries named > mgr/cephadm/cert_store.cert.grafana_cert and > mgr/cephadm/cert_store.key.grafana_key > which seem to cause this. > > AFAIK the certmgr is only available in Ceph 20. But the docs for this > version > look the same: > https://docs.ceph.com/en/tentacle/cephadm/services/monitoring/#configuring-… > > Only the docs for Ceph 21 got an update and mention certmgr: > https://docs.ceph.com/en/umbrella/cephadm/services/monitoring/#configuring-… > > > The orchestrator in Ceph 19 seems to have something called cert-store: > > # ceph orch cert-store > no valid command found; 4 closest matches: > orch cert-store cert ls [--format > {plain|json|json-pretty|yaml|xml-pretty|xml}] > orch cert-store key ls [--format > {plain|json|json-pretty|yaml|xml-pretty|xml}] > orch cert-store get cert <entity> [--service_name <value>] [--hostname > <value>] [--no-exception-when-missing] > orch cert-store get key <entity> [--service_name <value>] [--hostname > <value>] [--no-exception-when-missing] > Error EINVAL: invalid command > > But there is no help available. > "ceph orch cert-store --help" does not return anything specific. > Searching for "cert-store" in the Ceph 19 docs also does not return > anything. > > Regards

1 0