GitHub user nickaccuweb added a comment to the discussion: Experience with Ceph 19.2.6/20.2.4 regarding "CephX key type aes256k" - cloudstack compatibilty ?
@andkerber Yes, this can affect CloudStack environments using Ceph RBD primary storage with KVM. The issue was reproduced in CloudStack 4.22.1.1 with Ceph 20.2.4 and documented in [[CloudStack issue #13989](https://github.com/apache/cloudstack/issues/13989)](https://github.com/apache/cloudstack/issues/13989). CloudStack previously used the deprecated **auth_supported** option, which was removed in the newer Ceph releases. The fix in [[PR #13991](https://github.com/apache/cloudstack/pull/13991)](https://github.com/apache/cloudstack/pull/13991) replaces it with **auth_client_required**. This change has been merged into the CloudStack 4.22 branch and is targeted for version 4.22.2. There is also a separate compatibility issue with libvirt's RBD storage backend. An upstream libvirt fix was committed on October 14, 2026, but the fix may not yet be included in all Linux distribution packages. Regarding aes256k, Ceph recommends upgrading the client software before rotating CephX credentials. I would suggest testing the complete CloudStack, KVM, libvirt, and Ceph client combination before performing the production migration. For now, avoid enforcing aes256k exclusively until all clients have been verified. Ceph's documentation permits keeping both **aes** and **aes256k** enabled temporarily during the migration. References: - [[CloudStack PR #13991](https://github.com/apache/cloudstack/pull/13991)](https://github.com/apache/cloudstack/pull/13991) - [[libvirt compatibility issue #918](https://gitlab.com/libvirt/libvirt/-/work_items/918)](https://gitlab.com/libvirt/libvirt/-/work_items/918) - [[Official CephX migration documentation](https://docs.ceph.com/en/latest/rados/configuration/auth-config-ref/)](https://docs.ceph.com/en/latest/rados/configuration/auth-config-ref/) Regards, Nick R AccuWeb.Cloud GitHub link: https://github.com/apache/cloudstack/discussions/13964#discussioncomment-19450919 ---- This is an automatically sent email for [email protected]. To unsubscribe, please send an email to: [email protected]
