apache / apache/cloudstack

KVM agent fails to connect to Ceph RBD storage pool after upgrading Ceph client to Tentacle 20.2.4

Open Beginner friendly
#13,989 3 comments 0 reactions 0 assignees View on GitHub
bug component:ceph
Dominant language
Java
Stars
3.1k
Forks
1.4k
Avg merge
6d 19h
Merged PRs (30d)
32

Description

### problem

CloudStack builds its Ceph RBD connection strings with the legacy Ceph option `auth_supported=cephx.` This option was removed in Ceph Tentacle 20.2.4. As a result, every RBD operation performed by the KVM agent through librados now fails, and the agent cannot bring up the RBD storage pool:

```
**agent.err:**
libvirt: Storage Driver error : internal error: failed to set RADOS option: auth_supported

**agent.log:**
2026-08-27 00:00:13,468 ERROR [kvm.storage.LibvirtStorageAdaptor] (AgentRequest-Handler-3:[]) (logid:e0478a61) Failed to create RBD storage pool: org.libvirt.LibvirtException: internal error: failed to set RADOS option: auth_supported
2026-08-27 00:00:13,468 ERROR [kvm.storage.LibvirtStorageAdaptor] (AgentRequest-Handler-3:[]) (logid:e0478a61) Failed to create the RBD storage pool, cleaning up the libvirt secret
```
In ACS Host state is **Disconnected**

Code:
_plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/storage/KVMPhysicalDisk.java_, lines 56-62

### versions

ACS: 4.22.1.1
Hypervisor OS: KVM on Rocky Linux 9.8
libvirt: 11.10.0
Ceph client packages: librados2 / librbd1 / ceph-common 2:20.2.4-0.el9
Ceph cluster: 20.2.4 Tentacle

### The steps to reproduce the bug

1. Deploy a KVM host with Ceph RBD primary storage and cephx enabled.
2. Upgrade the Ceph client packages on the KVM host to 20.2.4 (Tentacle): librados2, librbd1, ceph-common.
3. Restart libvirtd and cloudstack-agent.

### What to do about it?

Remove `auth_supported`, it is redundant. When `id` and `key` are supplied, the client negotiates cephx anyway, and when they are not, it falls back to whatever `auth_client_required` in `ceph.conf` specifies.
It is also possible to use `auth_client_required` instead of `auth_supported`.

Contributor guide

Open the contributing guide

Research direction

Inspect plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/storage/KVMPhysicalDisk.java around lines 56-62, where CloudStack builds the Ceph RBD connection string. Remove the obsolete option and verify through the reproduction steps that the KVM agent can create the RBD storage pool with Ceph Tentacle 20.2.4.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
infrastructure
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Active
Clarity
Clearly specified
Newbie friendliness
78/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.