# tentacle Published articles for tentacle. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## \[CVE\] \[URGENT\] Squid v19.2.6 and Tentacle v20.2.4 released DevFeed: [\[CVE\] \[URGENT\] Squid v19.2.6 and Tentacle v20.2.4 released]() Original publisher: [Read original article]() Author: Patrick Donnelly Published: 2026-08-19T00:00:00Z Content type: release Language: en Sources: [Ceph Blog]() Topics: [releases](), [Authentication](), [Linux](), [client](), [monitor]() Tags: [authentication](), [blog-post](), [cve](), [cves](), [en-article](), [en-blog-post](), [errors](), [linux](), [process](), [release](), [releases](), [rest](), [rgw](), [squid](), [tentacle](), [upgrade]() ### AI overview The Ceph project released Tentacle 20.2.4 and Squid 19.2.6 as hotfixes addressing four CVEs. The article urgently recommends upgrading and explains changes to CephX key types, daemon-key rotation, authentication controls, recovery procedures, and multisite RGW request signing. ### Source excerpt The Ceph project has released Tentacle 20.2.4 and Squid 19.2.6 hotfixes for four CVEs across several components. This is the sixth backport release in the Squid series. This is the fourth backport release in the Tentacle series. We strongly recommend that all Ceph operators upgrade to one of these releases as soon as possible. Release Date ¶ August 19, 2026 Critical Upgrade Steps ¶ The fix for CVE-2025-30156 introduces a new CephX key type, aes256k. This is the first time Ceph has introduced a new key type for CephX credentials. Therefore, a new procedure exists for upgrading and rotating Ceph daemon keys as part of this CVE. Before upgrading a Ceph cluster, the operator should familiarize themselves with the procedure to upgrade CephX keys. These steps are for package-based deployments of Ceph. In other sections, the document also includes new information about key rotation procedures, monitor authentication controls, and emergency recovery procedures. Deployments using cephadm will automate the process except for client keys. You may notice that Cephadm spends more time than normal on the upgrade after updating all daemon images. This is due to a new process rotating the OSD and MDS keys. Please be patient. There are plans to improve this in the future. Deployments using Rook will also automate rotation of some client keys with some exclusions. Look to the Rook project's announcement for more details. Client and kernel upgrades are recommended to support aes256k. Note that upstream Linux kernel client support began in kernel 7.0 and has been backported to CentOS Stream 9 and 10. Check with your distribution vendor for backported key support before rotating client keys used by the kernel. As part of upgrading a Ceph cluster, six new health warnings and errors will be generated. This is normal. As part of the process to upgrade/rotate entity keys, you will address the warnings and errors as you go. These are documented beginning here. The CephX documentation has bee ## v20.2.3 Tentacle released DevFeed: [v20.2.3 Tentacle released]() Original publisher: [Read original article]() Author: Yuri Weinstein Published: 2026-08-05T00:00:00Z Content type: release Language: en Sources: [Ceph Blog]() Topics: [Deployment](), [Server](), [Hardware](), [TLS (Transport Layer Security)](), [Kafka](), [Grafana Cloud Metrics](), [Monitoring](), [Command-line interface](), [IO]() Tags: [2026](), [authentication](), [blog-post](), [cli](), [en-article](), [en-blog-post](), [hardware](), [io](), [kafka](), [metrics](), [monitoring](), [release](), [storage](), [tentacle](), [tls]() ### AI overview Ceph v20.2.3, the third minor release in the Tentacle series, is a recommended update containing fixes and improvements across metadata servers, object storage daemons, RADOS Gateway, client libraries, the dashboard, ceph-volume, and NVMe-oF. Changes include storage reliability fixes, TLS 1.3 cipher customization, encrypted object copying, Kafka notification authentication, hardware monitoring, CSV host uploads, and role-management updates. ### Source excerpt This is the third minor release in the Tentacle series. We recommend that all users update to this release. Release Date ¶ August 5, 2026 Notable Changes ¶ MDS (Metadata Server) ¶ Fixed a crash and shutdown hang that could occur when ephemeral pins were active and max_mds was set to 0. Session reclaim could miss blocklisting an old session; this is now handled correctly. Fixed a case where scrub was unable to identify damage from an irreparable hard link. OSD (Object Storage Daemon) ¶ BlueStore: Fixed a BlueFS WAL envelope-mode bug that caused write buffer misalignment. Erasure Coding: Fixed truncate+write planning for EC shard sizes. Fixed a condition that prevented rolling forward of PG log entries. Prevented OSDMap::check_health() from asserting when new OSDs are found in a subtree. Scrub: "repairing" scrubs -- deep scrubs re-run specifically to fix a previously detected inconsistency -- are no longer blocked by the configured allowed scrub hours/days; they can now run at any time. RGW (RADOS Gateway) ¶ Added the ssl_ciphersuites option for the Beast front-end to support TLS 1.3 cipher customization. Fixed PutObject's canned_acl comparison bug affecting BlockPublicAcls. Fixed crashes occurring on realm reload. Implemented CopyObject support for encrypted objects. Added mTLS client-certificate authentication support for Kafka notifications. Fixed removal of delete markers in lifecycle processing. RADOS / librados / neorados ¶ neorados: Fixed an infinite trim loop on empty data log shards. Fixed cancellation-slot cleanup in librados/asio's associated executor. Dashboard ¶ Added a hardware-monitoring dashboard backed by node-proxy metrics. Fixed a bind-address regression caused by CherryPy isolation. Added support for adding hosts via CSV upload. NVMeoF: multiple CLI and UI backports (EC pool support, IO statistics, role management). Object: The global RGW Roles tab has been removed. Role management is now scoped under RGW Accounts, where roles can be listed, created, ## Reclaim Ceph Capacity Through CephFS Transcoding DevFeed: [Reclaim Ceph Capacity Through CephFS Transcoding]() Original publisher: [Read original article]() Author: Anthony D'Atri Published: 2026-07-01T00:00:00Z Content type: article Language: en Sources: [Ceph Blog]() Topics: [Transcodings](), [Software](), [data]() Tags: [2026](), [4k](), [article](), [blog-post](), [ceph](), [cephfs](), [dram](), [efficiency](), [en-article](), [en-blog-post](), [enterprise](), [enterprise-storage](), [filesystem](), [fujitsu](), [git](), [hardware](), [performance](), [software](), [space](), [storage](), [tentacle]() ### AI overview This article addresses rising storage demands and hardware costs by discussing CephFS capacity efficiency. It describes replicated pools, Erasure Coding, and Fast EC in Ceph Tentacle, while the title identifies CephFS transcoding as the article's focus. ### Source excerpt Data expands to fill available storage (and beyond)! ¶ It used to be that enterprise storage meant 6RU rackmount Fujitsu 2351 Eagles, each holding a mind-boggling 380 MiB of data: enough for a whole company! Today that 380 MiB can't even hold a 4k pickleball video. Enterprises, educational instutitions, and really just about anyone these days demand storage capacities that start on the order of hundreds of tebibytes and rapidly grow to pebibytes. As this article is written in the spring of 2026, the memory market, which includes DRAM, SSDs, and legacy HDDs, has experienced a dramatic escalation of pricing. It is not uncommon to be quoted a price four times what the same hardware cost a year ago, and there are signs that it is going to get worse before it gets better. What's a poor ammonite to do?? Cephers find themselves between the Charybdis of quotes approaching Disaster Area's hypermathematics and the Scylla of hungry users armed with torches and git forks. Git forks, pitchforks. Get it? Sigh. Tough room. Anyway... Short of nuking the site from orbit, how do we make everyone happy, or at worst mildly discontented? Efficiency! CephFS ¶ CephFS is a popular, highly available and scalable software-defined POSIX-style distributed filesystem that can easily store tens of pebibytes of precious data. Or, alternately, cat videos. Ceph deployments often begin small, with replicated pools for perceived performance needs. As the cluster grows to more nodes and more data, it may become feasible and desirable to switch to Erasure Coding (EC) to make more efficient use of raw capacity. An EC pool thus can require substantially less raw storage for a given amount of user data, or store gobs more user data on a given amount of raw capacity This EC overhead table presents efficiency (space amplification) factors for a spectrum of EC profiles. Replicated pools usually maintain three copies of data, so for comparison they manifest an overhead factor of 3.0. EC 4+2 or 6+3 presents a ## v20.2.2 Tentacle released DevFeed: [v20.2.2 Tentacle released]() Original publisher: [Read original article]() Author: Yuri Weinstein, Patrick Donnelly Published: 2026-06-16T00:00:00Z Content type: release Language: en Sources: [Ceph Blog]() Topics: [bug](), [Vulnerabilities](), [Memory Leaks](), [Encryption](), [configuration](), [IO]() Tags: [2026](), [aio](), [blog-post](), [bug](), [ceph](), [configuration](), [en-article](), [en-blog-post](), [encryption](), [io](), [memory-leaks](), [rados](), [release](), [rgw](), [storage](), [tentacle](), [ui](), [update](), [vulnerabilities]() ### AI overview Ceph v20.2.2 Tentacle is a minor release that adds Rocky 10 package-install support and recommends updating. It fixes issues across MDS, OSD, RGW, RADOS libraries, watch/notify operations, asynchronous utilities, and the dashboard, including security vulnerabilities, memory leaks, encrypted-object lifecycle problems, and UI and configuration improvements. ### Source excerpt This is the second minor release in the Tentacle series. We recommend that all users update to this release. Release Date ¶ June 16, 2026 Notable Changes ¶ Rocky 10 package-based installs are now supported starting with v20.2.2. Please see the supported platforms for current and planned support in Ceph. MDS (Metadata Server) ¶ Segmentation fault fixed due to incorrect queueing of request retries. OSD (Object Storage Daemon) ¶ PGLog Missed List: Fixed a bug to ensure the correct version is attached to the missing list when ignoring log entries. Data Integrity Asserts: Added assertions to explicitly catch potential corruption in the OSD missing list. RGW (RADOS Gateway) ¶ Lifecycle Management: Fixed lifecycle transition issues affecting encrypted multipart objects. REST & Query Handling: RESTArgs::get_string() now properly URL-decodes incoming query parameters. RADOS / librados / neorados ¶ Linger Operations: Rewrote safety checks to eliminate use-after-free vulnerabilities and LingerOp memory leaks when an unwatch operation returns ENOTCONN. Replaced the flawed is_valid_watch() check with a safe linger_by_cookie() lookup which safely manages LingerOp references using intrusive_ptr. Ensured librados linger callbacks hold a persistent reference to LingerOp to protect against races with simultaneous linger_cancel() requests. Configured librados::IoCtxImpl::aio_unwatch() to asynchronously deliver ENOTCONN to AioCompletion instead of returning the error directly. Watch/Notify: Fixed neorados notification queue bounds enforcement so that an overflow marker is only appended on the first message exceeding capacity, rather than duplicating it on every subsequent message. Prevented double-cleanup triggers in watch/notify operations when incoming errors arrive after maybe_cleanup() runs. Fixed a bug where notify would lose original error values by ensuring it no longer attempts to decode empty responses. Enhanced io_context shutdown procedures to clear handlers and route cleanl ## v20.2.1 Tentacle released DevFeed: [v20.2.1 Tentacle released]() Original publisher: [Read original article]() Author: Yuri Weinstein Published: 2026-04-06T00:00:00Z Content type: release Language: en Sources: [Ceph Blog]() Topics: [bug](), [configuration](), [monitor](), [Command-line interface](), [API](), [dashboards](), [JSON]() Tags: [2026](), [api](), [blog-post](), [bug](), [cli](), [en-article](), [en-blog-post](), [json](), [monitor](), [nvme](), [osd](), [peering](), [policy](), [recovery](), [reef](), [release](), [rgw](), [tentacle](), [ui](), [workflows]() ### AI overview Ceph v20.2.1, the first minor release in the Tentacle series, is recommended for all users. The release fixes storage, recovery, peering, validation, and dashboard issues; restricts unsafe fast EC configurations; improves NVMeoF Gateway failover; adds listener and subsystem CLI commands; introduces a transient exclusive RBD lock policy; and updates dashboard navigation and forms. ### Source excerpt This is the first minor release in the Tentacle series. We recommend that all users update to this release. Release Date ¶ April 06, 2026 Notable Changes ¶ OSD / BlueStore ¶ EC Recovery: Fixed a length calculation bug in erase_after_ro_offset() that caused empty shards to retain data, leading to shard_size >= tobj_size assertion failures when recovering small objects in EC pools. BlueFS Volume Selector: Updated the BlueFS volume selector to properly account for file size changes when recovering the WAL in envelope mode. BlueFS: Fixed a bug where stat() missed the actual file size update after indexing WAL envelope files. Monitor (mon) ¶ Fast EC Restrictions: Denied the ability to enable EC optimizations ("fast EC") for non-4K-aligned chunk sizes. Unaligned chunk sizes handled by fast EC perform poorly and suffer from bugs, so attempts to force this configuration are now rejected. Peering: Ensured ceph pg repeer proposes a correctly sized pg temp, as optimized EC cannot cope with mismatched sizes. NVMeoF Gateway: Added a new nvme-gw listeners command to display all existing listeners (including auto-listeners) inside a pool/group. NVMeoF Failover: Overhauled the NVMeoF Gateway fast-failover logic. Beacon timeouts are now evaluated within prepare_beacon to support shorter intervals, and the mechanism for detecting monitor slowness was improved. librbd & rbd-mirror ¶ RBD: Introduced a new RBD_LOCK_MODE_EXCLUSIVE_TRANSIENT policy for rbd_lock_acquire(). This is a low-level interface intended to allow a peer to grab exclusive lock manually for short periods of time with other peers pausing their activity and waiting for the lock to be released rather than instantly aborting I/O and returning an error. It's possible to switch from RBD_LOCK_MODE_EXCLUSIVE to RBD_LOCK_MODE_EXCLUSIVE_TRANSIENT policy and vice versa even if the lock is already held. Ceph Object Gateway (RGW) ¶ Multi-Part Operations: Fixed conditional validation handling in MultiWrite, Delete, and MultiDelete