Public bug reported:
Package: libvirt (Ubuntu 24.04 noble, 10.0.0-2ubuntu8.19)
[ Impact ]
Ceph 20.2.4 removed the long-deprecated `auth_supported` RADOS option (upstream
Ceph commit 350cc71d7d9e). libvirt's
RBD storage backend still sets it every time it connects, so on a host with the
20.2.4 client libraries
(librados2/librbd1 from download.ceph.com, noble) every RBD pool start fails:
error: failed to start pool '<pool>'
error: failed to set RADOS option: auth_supported
Ceph 20.2.4 is the release that fixes CVE-2025-30156; clusters that enable only
the `aes256k` cipher need the 20.2.4
client, so users cannot stay on an older client to avoid the error. Apache
CloudStack and other users of libvirt RBD
pools on noble are blocked from using Ceph primary storage with a 20.2.4 client.
Upstream libvirt fixed this on 2026-10-14:
https://gitlab.com/libvirt/libvirt/-/commit/3af8cc51d5f5 ("replace rbd option
auth_supported with auth_*_required",
resolves libvirt work item 918). The change to
`src/storage/storage_backend_rbd.c` is 3 added / 2 removed lines and sets
`auth_client_required` instead; the remaining hunks touch libxl only.
[ Test Plan ]
1. noble host, libvirt 10.0.0-2ubuntu8.19, Ceph client packages 20.2.4 from
download.ceph.com (noble), a Ceph 20.2.4
cluster with cephx and a client key for an RBD pool.
2. Define an RBD pool with a cephx secret (`virsh pool-define` with
`<source><auth type='ceph' username='…'>`),
`virsh pool-start` → fails with the error above.
3. With the patched package: `virsh pool-start` succeeds, `virsh vol-create-as`
/ `vol-delete` work.
4. Regression: same test with the noble Ceph client (19.2.x) against a 19.2.x
cluster still starts the pool
(`auth_client_required` has existed in Ceph for many releases).
[ Where problems could occur ]
Only the RADOS connection setup of the RBD storage backend changes. A
regression would show as RBD pools failing to
start or authenticating differently. `auth_client_required` is the option Ceph
documents for clients; the removed
option was its deprecated alias for the client side. The libxl hunks of the
upstream commit are not needed for this
bug and can be left out of the backport.
[ Other info ]
- Reproduced on three noble KVM hosts in a test lab (25 Oct 2026). The same
hosts work with the 20.2.2 client and a
key using the legacy cipher, which is not an option for clusters that allow
only `aes256k`.
- Apache CloudStack fixed its own `qemu-img` paths for the same removal in PR
apache/cloudstack#13991 (4.22.2); the
pool start itself is libvirt's.
** Affects: libvirt (Ubuntu)
Importance: Undecided
Status: New
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2172324
Title:
libvirt RBD storage pool fails to start against Ceph 20.2.4: "failed
to set RADOS option: auth_supported"
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/libvirt/+bug/2172324/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
