This is the fifth minor release in the Tentacle series. We recommend that all users update to this release. Notable Changes Security - CephX: hardened service ticket verification. RGW (RADOS Gateway) - Added AES-256-GCM support for server-side encryption. - Added support for a global CORS rule, and CORS rules are now matched the way Amazon S3 matches them. - Added radosgw-admin bucket suspend and unsuspend commands. - Added --shard-id support to radosgw-admin gc process and gc list. - radosgw-admin bilog trim now requires --yes-i-really-mean-it. - STS Lite is deprecated for Tentacle. - Fixed conditional writes on versioning-suspended buckets. - Fixed SigV4 signature handling so Content-Type is no longer always required in the signature and x-amz-content-sha256 need not be a signed header. - S3 GetUsage now reads the user usage log. - Added Keystone scope information to ops logging. - Fixed several multisite issues: bucket object-lock sync, bucket reshard racing with index updates, and bilog autotrim on archive zones and stale bucket instance metadata. RADOS / OSD / BlueStore - BlueStore: fixed unsharing blobs on remove, stray spanning blobs produced by ExtentMap::reshard, onode cache stalls, and expanded space being added to the allocator after allocmap recovery. - BlueStore: BlueFS spillover cleaner improvements. - Autoscaler: PG autoscaling is now allowed for overlapped CRUSH roots, and PG distribution is fixed. - Scrub now auto-corrects accounting-only stat mismatches. - mClock: bounded the high_priority queue drain to prevent starvation. - pg_upmap_primary mappings are now removed for PG merge targets. - The read balancer no longer aborts on float rounding. - Reverted the msg/async/ProtocolV2 connection-speedup and netsplit grace period change. CephFS - MDS now persists the session auth_name in the ESession journal event. - The client accounts for mixed quotas in statfs. - cephfs-journal-tool can now scan and flush the journal in batches. - Fixed ceph fs perf stats handling of the json-pretty output format. RBD - It's possible to specify the source cluster's mon_host and key for native format migration via the migration spec now. This eliminates the dependency on a <cluster-name>.conf file in a known location, which is rather rigid and also challenging to disseminate in some environments. The key can be embedded in the migration spec or just referenced from there while stored in the MON config-key store. - Fixed a use-after-free in trash purge on image open error. - Fixed list_snaps() handling of non-existent groups in pybind/rbd. cephadm / NVMe-oF - Added a command to send signals to daemons. - Upgrades onto hosts whose CPU cannot run the target release are now blocked. - NVMe-oF gateways are disabled and enabled around host maintenance. - Added CNC and Prometheus frequency fields to the NVMe-oF spec file, --keep-connections to the NVMe-oF CLI, and --force to the NVMe-oF CLI delete kmip server command. - Fixed several NVMe-oF gateway monitor issues, including stretched-cluster relocate and beacon timeouts for gateways in the Created state. Dashboard - Upgraded Angular (19, then 20.3.29). - Backported the notification panel, overview page fixes, and a batch of other dashboard fixes. - OAuth2 SSO configuration fixes. Platform and Packaging - Ubuntu 24.04 is now a supported distro and container host. - Builds now use FUSE 3, and the C standard moved from C99 to C11. - s390x CRC assembly no longer requires an ELF executable stack. We recommend users to update to this release. For detailed release notes with links & changelog please refer to the official blog entry at https://ceph.io/en/news/blog/2026/v20-2-5-tentacle-released/ Getting Ceph - Git at git://github.com/ceph/ceph.git - Tarball at https://download.ceph.com/tarballs/ceph-20.2.5.tar.gz - Containers at https://quay.io/repository/ceph/ceph - For packages, see https://docs.ceph.com/en/latest/install/get-packages/ - Release git sha1: ed27c686770872022f4c1de04f6b0ac5d5384ded