Experience with Ceph 19.2.6/20.2.4 regarding "CephX key type aes256k" - cloudstack compatibilty ?

[andkerber]

Has anybody upgraded their Ceph Clusters to 19.2.6/20.2.4 yet and might share the experience regarding the new CephX key type aes256k cloudstack compatbility?

Over at Proxmox people a reporting issues about RBD operations and I wonder if this might concern cloudstack environments as well. Link: https://forum.proxmox.com/threads/pve-9-2-ceph-tentacle-20-2-4-rbd-operations-fail-because-pve-storage-passes-removed-auth_supported-option.185883/#post-866869

Ceph release announcement: https://ceph.io/en/news/blog/2026/v20-2-4-v19-2-6-combo-released/

[weizhouapache]

the cloudstack code has been updated: #13991

the issue is, libvirt still uses auth_supported: https://gitlab.com/libvirt/libvirt/-/work_items/918

[mathwest]

#13989 (comment)

Can confirm there are issues with 19.2.6 libs and cloudstack.

[nickaccuweb]

@andkerber

Yes, this can affect CloudStack environments using Ceph RBD primary storage with KVM.

The issue was reproduced in CloudStack 4.22.1.1 with Ceph 20.2.4 and documented in [CloudStack issue #13989](#13989).

CloudStack previously used the deprecated auth_supported option, which was removed in the newer Ceph releases. The fix in [PR #13991](#13991) replaces it with auth_client_required. This change has been merged into the CloudStack 4.22 branch and is targeted for version 4.22.2.

There is also a separate compatibility issue with libvirt's RBD storage backend. An upstream libvirt fix was committed on October 14, 2026, but the fix may not yet be included in all Linux distribution packages.

Regarding aes256k, Ceph recommends upgrading the client software before rotating CephX credentials. I would suggest testing the complete CloudStack, KVM, libvirt, and Ceph client combination before performing the production migration.

For now, avoid enforcing aes256k exclusively until all clients have been verified. Ceph's documentation permits keeping both aes and aes256k enabled temporarily during the migration.

References:

• [CloudStack PR #13991](fix: use auth_client_required instead of removed auth_supported for RBD #13991)
• [libvirt compatibility issue #918](https://gitlab.com/libvirt/libvirt/-/work_items/918)
• [Official CephX migration documentation](https://docs.ceph.com/en/latest/rados/configuration/auth-config-ref/)

Regards,
Nick R
AccuWeb.Cloud