- ceph-users - lists.ceph.io

Re: Rotation key after upgrade to 20.2.4
by Albert Shih 27 Aug '26

27 Aug '26

Le 27/08/2026 à 10:10:09+0000, Eugen Block a écrit Hi, > > please read all the sections in the docs ;-) > > https://docs.ceph.com/en/latest/rados/configuration/auth-config-ref/index.h… > > Although you use cephadm, step 6 is still relevant because it explains the > warning you're seeing: I read that, the problem is I just understand they are two types of keys :-( :-( > > > 6. Wipe the rotating service keys. > > Warning > > This is not recommended for most deployments. It is best to let your > > rotating service keys expire after a few hours (using default TTL). > > > Warning > > Only perform this step if all service daemons have upgraded binaries > > that understand the new cipher type. > > If you want to immediately clear the > > AUTH_INSECURE_ROTATING_SERVICE_KEY_TYPE warning, you can wipe the > > existing rotating service key database on the Monitors: > > > This is just a transitional state, the warning will go away after a few > hours (I'm not sure how long exactly). You're 100% right. The message just vannish. Thanks. Regards. -- Albert SHIH 🦫 🐸 Observatoire de Paris France Heure locale/Local time: jeu. 27 août 2026 14:19:14 CEST

1 0

Re: [CVE] [URGENT] Squid v19.2.6 and Tentacle v20.2.4 released
by Eugen Block 27 Aug '26

27 Aug '26

Apparently I either forgot that I have or really never have used 'ceph config set --force' before. :-D Thanks for pointing it out, Boris and Chris. Zitat von Christopher Durham <ceph-users(a)ceph.io>: > Boris, et al: > What this appears to mean is that the rgw_sigv4_insecure option does > not exist in releases prior to 19.2.6/20.2.4, but using 'force' sets > it anyway, so that when a 19.2.6 or 20.2.4 version of radosgw > starts, it will see it and use it. > I suspect that if a 19.2.6 or 20.2.4 radosgw starts without this > option it will fail to do replication to say an earlier radosgw > without the signature fix on the other side of a multisite that has > not yet updated. As we always have, we plan on doing the update on > one side of the multisite on day 1, and the other side on day 2. The > force option seems to make this possible without having to modify > ceph.conf everywhere. > If I am wrong, please someone correct me. Thanks. > -ChrisOn Tuesday, August 25, 2026 at 01:49:30 AM MDT, Boris > <bb(a)kervyn.de> wrote: > > Hi Matthew, > > we've set it with: > ceph config set client.rgw rgw_sigv4_insecure true --force > > Best > Boris > > > > Am Di., 25. Aug. 2026 um 09:41 Uhr schrieb Matthew Vernon > <ceph-users(a)ceph.io>: >> >> Hi, >> >> On 19/08/2026 17:09, Patrick Donnelly wrote: >> >> > If you are running multisite, you must set the ``rgw_sigv4_insecure`` >> > option to true before you begin to upgrade. After all clusters are >> > upgraded, set the option to ``false`` again. >> >> Stupid question - how/where does one set this, and will this be >> understood by older versions of Ceph? >> >> I ask because I have a Reef multisite setup, which should be supported >> to upgrade to Tentacle. Which I fear I'm now going to have to do in a hurry! >> >> AFAICT this is a new config setting, so I'd expect older versions of >> Ceph won't understand it... [and searching the reef docs doesn't find it] >> >> Thanks, >> >> Matthew >> _______________________________________________ >> ceph-users mailing list -- ceph-users(a)ceph.io >> To unsubscribe send an email to ceph-users-leave(a)ceph.io > > > > -- > Die Selbsthilfegruppe "UTF-8-Probleme" trifft sich diesmal abweichend > im groÃƒ¼en Saal. > _______________________________________________ > ceph-users mailing list -- ceph-users(a)ceph.io > To unsubscribe send an email to ceph-users-leave(a)ceph.io > > _______________________________________________ > ceph-users mailing list -- ceph-users(a)ceph.io > To unsubscribe send an email to ceph-users-leave(a)ceph.io

1 0

Re: Rotation key after upgrade to 20.2.4
by Eugen Block 27 Aug '26

27 Aug '26

Hi, please read all the sections in the docs ;-) https://docs.ceph.com/en/latest/rados/configuration/auth-config-ref/index.h… Although you use cephadm, step 6 is still relevant because it explains the warning you're seeing: > 6. Wipe the rotating service keys. > Warning > This is not recommended for most deployments. It is best to let your > rotating service keys expire after a few hours (using default TTL). > Warning > Only perform this step if all service daemons have upgraded binaries > that understand the new cipher type. > If you want to immediately clear the > AUTH_INSECURE_ROTATING_SERVICE_KEY_TYPE warning, you can wipe the > existing rotating service key database on the Monitors: This is just a transitional state, the warning will go away after a few hours (I'm not sure how long exactly). Regards, Eugen Zitat von Albert Shih <ceph-users(a)ceph.io>: > Hi everyone > > So today I upgrade (one of) my ceph cluster (cephadm), and indeed after > upgrading some time all osd come back to life and all osd key seem to be in > aes256k > > But still with ceph health detail I've got > > [WRN] AUTH_INSECURE_ROTATING_SERVICE_KEY_TYPE: 4 rotating auth > service keys using insecure key types > rotating service keys for mon using insecure key type: aes > rotating service keys for mds using insecure key type: aes > rotating service keys for osd using insecure key type: aes > rotating service keys for mgr using insecure key type: aes > > When I look in the documentation > > > https://docs.ceph.com/en/latest/rados/configuration/auth-config-ref/#cephx-… > > section 3 it seem I had to copy the keyring directly to the nodes of my > cluster who run those service, but inside > > /var/lib/ceph/CEPHID/* > > I didn't find any keyring file related to mon/mds/osd/mgr with aes key. > > So I'm a little confuse...in the documentation it's say in a note: > > The mon. historically has not been managed by the Monitor auth > database; it exists soley in each Monitor’s keyring inside its data > directory. This suggested rotation procedure now puts the > authoritative copy in the auth database alongside other keys. The > Monitor keyring persists as a fallback or emergency key. > > so where are those rotation key ? > > Regards > > -- > Albert SHIH 🦫 🐸 > France > Heure locale/Local time: > jeu. 27 août 2026 11:50:08 CEST > _______________________________________________ > ceph-users mailing list -- ceph-users(a)ceph.io > To unsubscribe send an email to ceph-users-leave(a)ceph.io

1 0

Rotation key after upgrade to 20.2.4
by Albert Shih 27 Aug '26

27 Aug '26

Hi everyone So today I upgrade (one of) my ceph cluster (cephadm), and indeed after upgrading some time all osd come back to life and all osd key seem to be in aes256k But still with ceph health detail I've got [WRN] AUTH_INSECURE_ROTATING_SERVICE_KEY_TYPE: 4 rotating auth service keys using insecure key types rotating service keys for mon using insecure key type: aes rotating service keys for mds using insecure key type: aes rotating service keys for osd using insecure key type: aes rotating service keys for mgr using insecure key type: aes When I look in the documentation https://docs.ceph.com/en/latest/rados/configuration/auth-config-ref/#cephx-… section 3 it seem I had to copy the keyring directly to the nodes of my cluster who run those service, but inside /var/lib/ceph/CEPHID/* I didn't find any keyring file related to mon/mds/osd/mgr with aes key. So I'm a little confuse...in the documentation it's say in a note: The mon. historically has not been managed by the Monitor auth database; it exists soley in each Monitor’s keyring inside its data directory. This suggested rotation procedure now puts the authoritative copy in the auth database alongside other keys. The Monitor keyring persists as a fallback or emergency key. so where are those rotation key ? Regards -- Albert SHIH 🦫 🐸 France Heure locale/Local time: jeu. 27 août 2026 11:50:08 CEST

1 0

Re: [CVE] [URGENT] Squid v19.2.6 and Tentacle v20.2.4 released
by Albert Shih 27 Aug '26

27 Aug '26

Le 20/08/2026 à 19:55:02+0000, Salatiel Filho a écrit > Hi, I also miss in the docs the steps for those clients that are not > daemons? ( cephadm managed ) > > entity client.admin using insecure key type: aes They are a section (8) for the client.admin key rotation in the official documentation : https://docs.ceph.com/en/latest/rados/configuration/auth-config-ref/#cephx-… I didn't do it currently so no way to tell if that's work or not. Regards -- Albert SHIH 🦫 🐸 France Heure locale/Local time: jeu. 27 août 2026 11:48:06 CEST

1 0

Re: Ubuntu 24.04 Noble package support for Ceph 20.2.x
by Casey Bodley 27 Aug '26

27 Aug '26

according to Patrick in https://lists.ceph.io/hyperkitty/list/ceph-users@ceph.io/message/UEGCE3TKWY…, ubuntu 24.04 support will be added for tentacle in 20.2.5 On Wed, Aug 26, 2026 at 11:41 AM Martin Vobruba <ceph-users(a)ceph.io> wrote: > > Hi, > > I'd like to ask about the status of Ubuntu 24.04 Noble package support for > the Ceph 20.2.x release series. When I originally deployed the cluster, > packages for Noble were available and our clients are currently running > Ceph 20.2.2 on Ubuntu 24.04. However, I noticed that Noble packages are no > longer available for newer 20.2.x releases. I would like to upgrade the > clients to 20.2.4, primarily to get the fix for the insecure keys issue. > > Is the lack of Noble packages temporary? If so, is there any estimate for > when Ubuntu 24.04 packages for the 20.2.x branch will become available > again? Also, is there a recommended upgrade path for Noble clients > currently running 20.2.2 in the meantime? > > Thanks for any clarification. > > Best regards, > Martin > _______________________________________________ > ceph-users mailing list -- ceph-users(a)ceph.io > To unsubscribe send an email to ceph-users-leave(a)ceph.io >

2 1

Re: [CVE] [URGENT] Squid v19.2.6 and Tentacle v20.2.4 released
by Christopher Durham 26 Aug '26

26 Aug '26

Boris, et al: What this appears to mean is that the rgw_sigv4_insecure option does not exist in releases prior to 19.2.6/20.2.4, but using 'force' sets it anyway, so that when a 19.2.6 or 20.2.4 version of radosgw starts, it will see it and use it. I suspect that if a 19.2.6 or 20.2.4 radosgw starts without this option it will fail to do replication to say an earlier radosgw without the signature fix on the other side of a multisite that has not yet updated. As we always have, we plan on doing the update on one side of the multisite on day 1, and the other side on day 2. The force option seems to make this possible without having to modify ceph.conf everywhere. If I am wrong, please someone correct me. Thanks. -ChrisOn Tuesday, August 25, 2026 at 01:49:30 AM MDT, Boris <bb(a)kervyn.de> wrote: Hi Matthew, we've set it with: ceph config set client.rgw rgw_sigv4_insecure true --force Best Boris Am Di., 25. Aug. 2026 um 09:41 Uhr schrieb Matthew Vernon <ceph-users(a)ceph.io>: > > Hi, > > On 19/08/2026 17:09, Patrick Donnelly wrote: > > > If you are running multisite, you must set the ``rgw_sigv4_insecure`` > > option to true before you begin to upgrade. After all clusters are > > upgraded, set the option to ``false`` again. > > Stupid question - how/where does one set this, and will this be > understood by older versions of Ceph? > > I ask because I have a Reef multisite setup, which should be supported > to upgrade to Tentacle. Which I fear I'm now going to have to do in a hurry! > > AFAICT this is a new config setting, so I'd expect older versions of > Ceph won't understand it... [and searching the reef docs doesn't find it] > > Thanks, > > Matthew > _______________________________________________ > ceph-users mailing list -- ceph-users(a)ceph.io > To unsubscribe send an email to ceph-users-leave(a)ceph.io -- Die Selbsthilfegruppe "UTF-8-Probleme" trifft sich diesmal abweichend im groÃƒ¼en Saal. _______________________________________________ ceph-users mailing list -- ceph-users(a)ceph.io To unsubscribe send an email to ceph-users-leave(a)ceph.io

1 0

Re: [CVE] [URGENT] Squid v19.2.6 and Tentacle v20.2.4 released
by Chris Palmer 26 Aug '26

26 Aug '26

Yeah, I manually replaced the old key in each hosts authorized_keys file (just before I saw your email!). Then it went away. This is a recurring sort of theme with cephadm though. It is supposed to abstract away many of the implementation details. But then the documentation doesn't cover it, so you have to guess what it should have done, and then fix it manually... Thanks, Chris On 26/08/2026 13:43, Eugen Block wrote: > Hi, > > did you add the new pub key to all the host's authorized_keys? > > clear-key and then generate-key is the correct way. > > Zitat von Chris Palmer <ceph-users(a)ceph.io>: > >> I've attempted to rotate the SSH keys on a 20.2.4 test cluster, and >> now it is broken: >> >> The note below points towards the SSH Configuration section. That >> doesn't have anything specific about rotation, so I had to make some >> guesses. >> >> It says that a new SSH key can be generated with "ceph cephadm >> generate-key". It doesn't give any error, but using "ceph cephadm >> get-pub-key" suggests it hasn't actually done anything (I still get >> the original ssh-rsa key). The doc probably needs clarifying. >> >> So I tried "ceph cephadm clear-key" which worked, and then "ceph >> cephadm generate-key" again. This time I can see a new ssh-ed25519 >> key. I then failed all MGRs. >> >> Now however I have this for every host: >> >> root@c1:~# ceph cephadm check-host c2 >> check-host failed: >> Failed to connect to c2 at address (192.168.nnn.162): Failed to >> connect to c2 (192.168.nnn.162). Permission denied >> Log: Opening SSH connection to 192.168.nnn.162, port 22 >> [conn=9] Connected to SSH server at 192.168.nnn.162, port 22 >> [conn=9] Local address: 192.168.nnn.161, port 35514 >> [conn=9] Peer address: 192.168.nnn.162, port 22 >> [conn=9] Beginning auth for user root >> [conn=9] Auth failed for user root >> [conn=9] Connection failure: Permission denied >> [conn=9] Aborting connection >> >> Have I done this incorrectly, or is the documentation wrong? What is >> the correct way to rectify this? >> >> Thanks, Chris >> >> On 19/08/2026 17:07, Patrick Donnelly wrote: >>> Today, August 19th, 2026, the Ceph project has released Tentacle >>> 20.2.4 and Squid 19.2.6 hotfixes for four CVEs across several >>> components. >>> >>> This is the sixth backport release in the Squid series. >>> >>> This is the fourth backport release in the Tentacle series. >>> >>> Additional details will be posted on the Ceph website/blog: >>> https://ceph.io/en/news/blog/ >>> >>> We strongly recommend that all Ceph operators upgrade to one of these >>> releases as soon as possible. >>> >>> >>> ## Critical Upgrade Steps >>> >>> The fix for CVE-2025-30156 introduces a new CephX key type, aes256k. >>> This is the first time Ceph has introduced a new key type for CephX >>> credentials. Therefore, a new procedure exists for upgrading and >>> rotating Ceph daemon keys as part of this CVE. Before upgrading a Ceph >>> cluster, the operator should familiarize themselves with the procedure >>> documented at: >>> >>> https://docs.ceph.com/en/latest/rados/configuration/auth-config-ref/index.h… >>> >>> >>> These steps are for package-based deployments of Ceph. In other >>> sections, the document also includes new information about key >>> rotation procedures, monitor authentication controls, and emergency >>> recovery procedures. >>> >>> Deployments using cephadm will automate the process except for client >>> keys. You may notice that Cephadm spends more time than normal on the >>> upgrade after updating all daemon images. This is due to a new process >>> rotating the OSD and MDS keys. Please be patient. There are plans to >>> improve this in the future. >>> >>> Deployments using Rook will also automate rotation of some client keys >>> with some exclusions. Look to the Rook project’s announcement for more >>> details. >>> >>> Client and kernel upgrades are recommended to support aes256k. Note >>> that upstream Linux kernel client support began in kernel 7.0 and has >>> been backported to CentOS Stream 9 and 10. Check with your >>> distribution vendor for backported key support before rotating client >>> keys used by the kernel. >>> >>> As part of upgrading a Ceph cluster, six new health warnings and >>> errors will be generated. This is normal. As part of the process to >>> upgrade/rotate entity keys, you will address the warnings and errors >>> as you go. These are documented beginning here: >>> >>> https://docs.ceph.com/en/latest/rados/operations/health-checks/index.html#a… >>> >>> >>> The CephX documentation has been brought up to date and vetted for >>> accuracy. Those changes are live here: >>> >>> https://docs.ceph.com/en/latest/architecture/index.html#high-availability-a… >>> >>> >>> Regarding the fix for CVE-2026-54330, RGW will now reject Sigv4 >>> requests with `host` and `x-amz-` headers not included in the signed >>> subset. Unfortunately, the REST client used in multisite was >>> generating such improperly signed requests. >>> >>> If you are running multisite, you must set the ``rgw_sigv4_insecure`` >>> option to true before you begin to upgrade. After all clusters are >>> upgraded, set the option to ``false`` again. >>> >>> Regarding the fix for CVE-2026-50152, formal guidance on rotating all >>> secrets stored in the Monitor config-key store will be forthcoming. In >>> the meantime, operators of cephadm-managed clusters are strongly >>> encouraged to rotate the cephadm SSH key, as an established process >>> exists: >>> >>> See: >>> https://docs.ceph.com/en/latest/cephadm/host-management/#ssh-configuration >>> >>> Rotating other secrets is advised but the process is not yet >>> established. Operators should assess their cluster's potential >>> exposure to determine if immediate Monitor config-key secret rotation >>> is required for their environment. >>> >>> >>> ## CVE Fixes >>> >>> * CVE-2025-30156 is an authentication bypass in CephX caused by misuse >>> of AES-CBC. >>> >>> See: https://docs.ceph.com/en/latest/security/CVE-2025-30156 >>> >>> * CVE-2026-39944 shares the unauthenticated-encryption root cause of >>> CVE-2025-30156, but applies it to RGW's STS session tokens resulting >>> in improper verification of a cryptographic signature. >>> >>> See: https://docs.ceph.com/en/latest/security/CVE-2026-39944 >>> >>> * CVE-2026-50152 is an improper authorization flaw in the Ceph Monitor >>> subscription handler. >>> >>> See: https://docs.ceph.com/en/latest/security/CVE-2026-50152 >>> >>> * CVE-2026-54330 is a flaw in RGW not properly verifying its SigV4 >>> cryptographic signatures in RGW's SigV4 verifier. >>> >>> See: https://docs.ceph.com/en/latest/security/CVE-2026-54330 >>> >>> ## Other Media >>> >>> A Cephalocon 2025 talk covers some of the details surrounding the new >>> CephX key upgrade process. >>> >>> https://cephalocon2025.sched.com/event/27f2O/rotating-heads-and-cephx-keys-… >>> >>> >>> ## Getting Ceph >>> ------------ >>> * Source at https://github.com/ceph/ceph >>> * v19.2.6 Tarball at >>> https://download.ceph.com/tarballs/ceph-19.2.6.tar.gz >>> * v20.2.4 Tarball at >>> https://download.ceph.com/tarballs/ceph-20.2.4.tar.gz >>> * Containers at https://quay.io/repository/ceph/ceph >>> * For packages, see >>> https://docs.ceph.com/en/latest/install/get-packages/ >>> * For upgrade with cephadm, see: >>> https://docs.ceph.com/en/latest/cephadm/upgrade/ >>> * v19.2.6 Release git sha1: f9fd95b4335bad6a26d7a74468f55d269e8dbef4 >>> * v20.2.4 Release git sha1: 7f793731f1b39eb4f465e960113d2363c311b964 >>> >> _______________________________________________ >> ceph-users mailing list -- ceph-users(a)ceph.io >> To unsubscribe send an email to ceph-users-leave(a)ceph.io > > > _______________________________________________ > ceph-users mailing list -- ceph-users(a)ceph.io > To unsubscribe send an email to ceph-users-leave(a)ceph.io

2 1

Ubuntu 24.04 Noble package support for Ceph 20.2.x
by Martin Vobruba 26 Aug '26

26 Aug '26

Hi, I'd like to ask about the status of Ubuntu 24.04 Noble package support for the Ceph 20.2.x release series. When I originally deployed the cluster, packages for Noble were available and our clients are currently running Ceph 20.2.2 on Ubuntu 24.04. However, I noticed that Noble packages are no longer available for newer 20.2.x releases. I would like to upgrade the clients to 20.2.4, primarily to get the fix for the insecure keys issue. Is the lack of Noble packages temporary? If so, is there any estimate for when Ubuntu 24.04 packages for the 20.2.x branch will become available again? Also, is there a recommended upgrade path for Noble clients currently running 20.2.2 in the meantime? Thanks for any clarification. Best regards, Martin

1 0

Re: Cephadm staggered upgrade --limit parameter not always applied
by Eugen Block 26 Aug '26

26 Aug '26

Hi, I haven't found anything explaining this yet, but I also haven't looked for a while. I just retried limiting RGW upgrade (from Reef to Tentacle): reef1:~ # ceph orch upgrade start --image quay.io/ceph/ceph:v20.2.4 --daemon-types rgw --limit 1 But the limit is still ignored: 2026-08-26T10:15:23.709+0000 7f8c09d01640 0 [cephadm INFO cephadm.upgrade] Upgrade: Updating rgw.nde.reef1.pmauyp (1/1) 2026-08-26T10:15:23.709+0000 7f8c09d01640 0 log_channel(cephadm) log [INF] : Upgrade: Updating rgw.nde.reef1.pmauyp (1/1) 2026-08-26T10:15:26.554+0000 7f8c09d01640 0 [cephadm INFO cephadm.upgrade] Upgrade: Updating rgw.nde.reef2.oqrpma (1/1) 2026-08-26T10:15:26.555+0000 7f8c09d01640 0 log_channel(cephadm) log [INF] : Upgrade: Updating rgw.nde.reef2.oqrpma (1/1) 2026-08-26T10:15:29.133+0000 7f8c09d01640 0 [cephadm INFO cephadm.upgrade] Upgrade: Updating rgw.nde.reef3.boujxu (1/1) 2026-08-26T10:15:29.133+0000 7f8c09d01640 0 log_channel(cephadm) log [INF] : Upgrade: Updating rgw.nde.reef3.boujxu (1/1) All three RGW daemons have been upgraded automatically. I'm pretty sure that it worked at some point with RGWs, in my notes from one of our customer upgrades where this worked: ceph orch upgrade start --image registry:5000/ceph/ceph:v18.2.5 --daemon-types rgw --limit 1 I can't tell when it stopped working properly. Regards, Eugen Zitat von Andreas Eriksson <norrland(a)nullbyte.se>: > Hi, > > Were you able to find anything more about this? I'm looking at > upgrading a bunch of clusters from previous major versions, but do > not want to upgrade all RGW services. And also limit the number of > osds at the time that are being upgraded, to keep the recovery > traffic lower for example. > > Br, > > On 3/17/26 3:35 PM, Eugen Block via ceph-users wrote: >> Adding the dev list >> >> Zitat von Eugen Block <eblock(a)nde.ag>: >> >>> Hi, >>> >>> I did a quick search on tracker but couldn't find anything >>> related. A customer reported this, and I can confirm the behaviour >>> on a lab cluster. I usually perform a staggered upgrade with >>> --daemon-types and --limit, but not for all daemon types. So I >>> haven't stumbled across this yet myself, but our customer did (I >>> can reproduce with --daemon-types as well). They upgraded from >>> latest Reef to latest Squid and reported that despite providing >>> the --limit parameter, the mons were all upgraded. So I tried to >>> reproduce, and the behaviour is not really clear to me, I'll try >>> to clarify. >>> >>> # Start with MGRs >>> >>> reef1:~ # ceph orch upgrade start --image >>> quay.io/ceph/ceph:v19.2.3 --services mgr --limit 1 >>> >>> Upgrading MGRs with limit works, but it doesn't reflect in the MGR >>> log. Usually, I expect a line like this: >>> >>> ...[cephadm INFO root] Hit upgrade limit of 1. Stopping upgrade >>> >>> But there is no such line in the logs. Then I upgrade the rest of the MGRs. >>> >>> # Continue with MONs >>> >>> reef1:~ # ceph orch upgrade start --image >>> quay.io/ceph/ceph:v19.2.3 --services mon --limit 1 >>> >>> This gets even weirder, the orchestrator upgrades 2 out of 3 MONs. >>> And again, no such line in the log (Hit upgrade limit). What I >>> noticed was a MGR respawn after the first MON had been upgraded >>> successfully. Maybe some state of the upgrade progress gets lost >>> during the respawn? I then upgraded the remaining MON. Then >>> ceph-crash is upgraded successfully. >>> >>> # Upgrade OSD >>> >>> reef1:~ # ceph orch upgrade start --image >>> quay.io/ceph/ceph:v19.2.3 --services osd.osd.standalone --limit 1 >>> >>> And this is the first service that actually reports the upgrade limit: >>> >>> 2026-03-05T15:47:17.108+0000 7f5bfdc73640 0 [cephadm INFO >>> cephadm.upgrade] Upgrade: Updating osd.0 (1/1) >>> 2026-03-05T15:47:17.108+0000 7f5bfdc73640 0 log_channel(cephadm) >>> log [INF] : Upgrade: Updating osd.0 (1/1) >>> 2026-03-05T15:47:32.518+0000 7f5bfdc73640 0 [cephadm INFO root] >>> Hit upgrade limit of 1. Stopping upgrade >>> 2026-03-05T15:47:32.518+0000 7f5bfdc73640 0 log_channel(cephadm) >>> log [INF] : Hit upgrade limit of 1. Stopping upgrade >>> 2026-03-05T15:47:47.395+0000 7f5bfdc73640 0 [cephadm INFO >>> cephadm.upgrade] Upgrade: Setting container_image for all nvmeof >>> 2026-03-05T15:47:47.395+0000 7f5bfdc73640 0 log_channel(cephadm) >>> log [INF] : Upgrade: Setting container_image for all nvmeof >>> 2026-03-05T15:47:47.492+0000 7f5bfdc73640 0 [cephadm INFO >>> cephadm.upgrade] Upgrade: Finalizing container_image settings >>> 2026-03-05T15:47:47.493+0000 7f5bfdc73640 0 log_channel(cephadm) >>> log [INF] : Upgrade: Finalizing container_image settings >>> 2026-03-05T15:47:47.667+0000 7f5bfdc73640 0 [cephadm INFO >>> cephadm.upgrade] Upgrade: Complete! >>> 2026-03-05T15:47:47.667+0000 7f5bfdc73640 0 log_channel(cephadm) >>> log [INF] : Upgrade: Complete! >>> >>> >>> This is really irritating and inconsistent: If the orchestrator >>> does honor --limit with other services than OSD, why isn't that >>> visible in the logs? And what's with the MONs? Why 2 out of 3? >>> >>> Any pointers appreciated! Not sure which Ceph versions might be >>> affected by this, I'll try out a couple more upgrade paths. >>> >>> Thanks, >>> Eugen >> >> >> _______________________________________________ >> ceph-users mailing list -- ceph-users(a)ceph.io >> To unsubscribe send an email to ceph-users-leave(a)ceph.io

1 1