feat(container)!: Update image quay.io/ceph/ceph (v20.2.4 ➔ v21.1.0)

[renovate]

This PR contains the following updates:

Package	Update	Change
quay.io/ceph/ceph	major	v20.2.4 → v21.1.0

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Configuration

📅 Schedule: (in timezone Europe/Brussels)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[tanguille-cluster]

@@ spec.template.spec.containers.rook-ceph-tools.image @@
# apps/v1/Deployment/rook-ceph/rook-ceph-tools
! ± value change
- quay.io/ceph/ceph:v20.2.4@sha256:6bb1c8a42fbc0bf87938946990b65174466997bc11c31eb5a323225a779fd8f9
+ quay.io/ceph/ceph:v21.1.0@sha256:5ff3692d2f3f4bf47ca7717de6f8f8556440ce3e15efaa680b62cb924eec0541

@@ spec.cephVersion.image @@
# ceph.rook.io/v1/CephCluster/rook-ceph/rook-ceph
! ± value change
- quay.io/ceph/ceph:v20.2.4@sha256:6bb1c8a42fbc0bf87938946990b65174466997bc11c31eb5a323225a779fd8f9
+ quay.io/ceph/ceph:v21.1.0@sha256:5ff3692d2f3f4bf47ca7717de6f8f8556440ce3e15efaa680b62cb924eec0541

[tanguille-cluster]

@@ spec.values.cephImage.tag @@
# helm.toolkit.fluxcd.io/v2/HelmRelease/rook-ceph/rook-ceph-cluster
! ± value change
- v20.2.4@sha256:6bb1c8a42fbc0bf87938946990b65174466997bc11c31eb5a323225a779fd8f9
+ v21.1.0@sha256:5ff3692d2f3f4bf47ca7717de6f8f8556440ce3e15efaa680b62cb924eec0541

[github-actions]

AI Automated Review

Analysis engine: omniroute@http://litellm.ai.svc.cluster.local/v1 (openai)

Recommendation: Request changes — do not merge this major Ceph bump until the Rook chart version and host-kernel compatibility are verified.

This is a major Ceph upgrade (v20.2.4 → v21.1.0, i.e. Quincy 20.x → Reef/Tentacle 21.x) that only bumps the cephImage tag in helmrelease.yaml. The Rook operator/CSI chart versions are pinned elsewhere (the rook-ceph-cluster OCIRepository), and a Ceph 21 cluster requires a Rook release that explicitly supports it; the diff does not touch those pins, so the operator may be too old to manage the new daemons.

• Manifest vs target cluster: the YAML is well-formed and internally consistent, but I could not confirm the Rook chart/operator version supports Ceph 21 — see Unknowns.
• Resource quota / limits: no changes; OSD/MON/MGR requests and limits are untouched by this diff.

Release notes: Not verified. Ceph's official release-notes hosts (docs.ceph.com, ceph.io) are outside the allowed fetch list, so I could not enumerate the v20.2.4→v21.1.0 range or its breaking changes. A cross-major Ceph upgrade typically involves on-disk format, msgr2, and cephx/cipher behavior changes that must be confirmed before rolling out.

Tool Harness Findings

• Read the full helmrelease.yaml: the change is a single-line image-tag bump; all other values (security.ciphers aes256k, resources, storage nodes) are unchanged.
• Web searches for "Ceph v21.1.0 release notes" returned no authoritative Ceph page; both web_fetch attempts (docs.ceph.com/en/latest/releases/, ceph.io/en/news/blog/) failed with "Host not allowlisted." Release notes therefore remain unverified.

Unknowns or Needs Verification

• Rook chart/operator version supporting Ceph 21 was not in the corpus and could not be fetched — verify the rook-ceph-cluster OCIRepository pin before merging.
• Ceph v21.1.0 release notes / breaking changes — not verified (host not allowlisted).
• Host kernel requirement: the manifest comment states aes256k needs the in-kernel client from Linux 7.0; confirm all three control nodes run ≥7.0 before the upgrade.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 083d4686-4a94-4488-84fa-0e1b3a44041b

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

📝 Walkthrough

Walkthrough

The Rook Ceph HelmRelease updates its pinned Ceph container image from v20.2.2 to v21.1.0, including the image digest.

Changes

Rook Ceph image update

Layer / File(s)	Summary
Update pinned Ceph image kubernetes/apps/rook-ceph/rook-ceph/cluster/helmrelease.yaml	The cephImage.tag value is updated from the Ceph v20.2.2 image digest to the v21.1.0 image digest.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Possibly related PRs

• Tanguille/cluster#4238: Updates Rook Ceph versions in the same deployment through different components and files.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the Ceph image update and the target major version upgrade, which matches the primary change.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch renovate/quay.io-ceph-ceph-21.x

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[deepsource-io]

DeepSource Code Review

We reviewed changes in b35196f...f0d267e on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.

See full review on DeepSource ↗

PR Report Card

Overall Grade

Security   Reliability   Complexity   Hygiene

Code Review Summary

Analyzer	Status	Updated (UTC)	Details
JavaScript		Sep 3, 2026 11:03a.m.	Review ↗
Shell		Sep 3, 2026 11:03a.m.	Review ↗

---

Important

AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.

[coderabbitai]

Warning

Your free Security trial is over. An organization admin can activate billing to continue.

[Tanguille]

Holding. Two reasons, both independent of the reviewer findings:

1. v21.1.0 is a release candidate, not stable. Ceph uses x.0.z for dev and x.1.z for RC; the first stable v21 will be 21.2.0. Renovate is tracking the tag stream here without a stability filter.
2. Timing. The cluster is mid-migration on the cephx aes to aes256k cipher (rotation to gen 4 is done, keepPriorKeyCountMax: 1 still retains gen-3 aes keys, and allowedCiphers has not been narrowed yet). Stacking a Ceph major on top of an unfinished auth migration removes the ability to attribute a failure to either one.

Current state for the record: Rook chart v1.20.6, operator reports 20.2.4-0 tentacle, require-osd-release tentacle, 3/3 OSDs on 7f793731f1b39eb4f465e960113d2363c311b964.

The reviewer blockers asking for the Rook support matrix are directionally right, but the version naming in them is garbled (v21 is called Reef in one and Squid in another; v20 is Tentacle, v19 is Squid, Reef is v18). Revisit when 21.2.0 ships and the cephx migration is closed out.

[github-actions]

Inline findings from the automated review (summary in the sticky comment).

[github-actions]

⚠️ Major: Major Ceph 20→21 bump without a corresponding Rook operator/CSI chart version check; the rook-ceph-cluster OCIRepository pin is unchanged and may not support Ceph 21.

Automated finding from AI PR review.

[github-actions]

Info (docs): Ceph v21.1.0 release notes and breaking changes could not be verified because docs.ceph.com and ceph.io are not on the allowed fetch list.

Automated finding from AI PR review.