Ceph v21.2.0 Umbrella: x86‑64‑v3 CPUs Required for Containers

Operators who plan to run Ceph v21.2.0 Umbrella must check their hosts before anything else. The Ceph.io — v21.2.0 Umbrella released post, dated October 28, 2026, describes Umbrella as the 21st stable Ceph release and the first stable Umbrella release, and recommends that all users update. The release needs an x86-64-v3 CPU for containerized daemons and Python 3.9 or newer on every host, and it changes several defaults that affect pools and OSDs. This guide gives the order of the work and the settings to review.

Migration Order for Umbrella Hosts and Pools #

Work through the upgrade in this order. The host checks come first because they decide whether the containers can run at all. Host requirements come first, followed by erasure-coded pools, PG and OSD defaults, and the settings that take effect after the upgrade.

1. Confirm that every host runs Python 3.9 or newer.
2. Confirm that every host that runs containerized daemons supports the x86-64-v3 microarchitecture level.
3. Check erasure-coded pools for non-4k-aligned chunk sizes, and check Blaum-Roth profiles whose w+1 is not prime.
4. Check the PG autoscaler inputs, and decide whether to pin the old values for the clusters described below.
5. Check osd_op_num_shards_hdd and osd_op_num_threads_per_shard_hdd on HDD OSDs.
6. Settle the election strategy before enabling stretch mode.
7. After the upgrade, review pools that autoscaled, and retest presigned PUT clients against RGW.

x86-64-v3 CPUs Are Required for Container Hosts #

The Umbrella container images are based on Rocky Linux 10 (el10), and the Ceph.io — v21.2.0 Umbrella released notes list this as a warning. A host must support the x86-64-v3 microarchitecture level to run the containerized daemons. The same release notes list the Ceph container's base OS image as rockylinux:10, so the requirement applies to each host that runs containers.

Python 3.9 Is Required on Every Host for cephadm #

The release notes list two host requirements as warnings, and this is the second. Python 3.9 or newer is required on all hosts for cephadm support. The x86-64-v3 requirement covers container hosts, while the Python requirement covers all hosts, so the two checks do not overlap.

Erasure-Coded Pools: Non-4k Chunk Sizes Are Rejected #

The release adds an optimized ("Fast") erasure coding I/O path, with EC Direct Reads, CLS support for EC reads, EC OMAP support, and Fast EC CRC checking for data and the first parity. The release also lists numerous correctness fixes in the new path, including truncate plus write planning and PDW versus RMW selection. The chunk-size rule is the change that can refuse an existing pool:

non-4k-aligned chunk sizes are now rejected for optimized EC

Ceph.io — v21.2.0 Umbrella released

This suggests that a pool with a chunk size that is not 4k-aligned will not use the optimized path, so chunk sizes should be checked before the upgrade. The same release ships health warnings for deprecated EC plugins and techniques, and for Blaum-Roth profiles whose w+1 is not prime. Check those profiles before the upgrade, because the warnings appear once the cluster runs v21.2.0.

PG Autoscaler Defaults: More PGs per OSD After Upgrade #

The release raises two autoscaler defaults. The notes state that mon_target_pg_per_osd increases from 100 to 200, and mon_max_pg_per_osd increases from 250 to 500, which lets the autoscaler compute more parallelism-friendly pg_num values. Existing pools may autoscale to more PGs after upgrading. The pg_autoscale_during_upgrade change (pr#67694) paces that splitting so it does not disrupt the upgrade itself.

This is the old way, with the defaults that the release replaces:

mon_target_pg_per_osd = 100
mon_max_pg_per_osd = 250

This is the new way, with the defaults in v21.2.0:

mon_target_pg_per_osd = 200
mon_max_pg_per_osd = 500

Clusters with a smaller-than-4GiB effective bluestore_osd_memory_target, or with SSDs split into more than two OSDs, may want to pin the old values before upgrading (pr#69452). The notes do not say which values to pin, so that decision depends on the entry for pr#69452.

HDD OSD Shard Defaults: One Shard and Five Threads #

This change is an interim fix for inconsistent client and recovery throughput with multiple shards (issue#66289). The release lists both keys in one change: osd_op_num_shards_hdd moves from 5 to 1, and osd_op_num_threads_per_shard_hdd moves from 1 to 5. An HDD OSD that keeps no explicit value for these keys gets the new layout.

This is the old way, with the defaults that the release replaces:

osd_op_num_shards_hdd = 5
osd_op_num_threads_per_shard_hdd = 1

This is the new way, with the defaults in v21.2.0:

osd_op_num_shards_hdd = 1
osd_op_num_threads_per_shard_hdd = 5

Check whether either key is set in your configuration, and compare any value you set with the new defaults after the upgrade.

CephX Defaults to AES256KRB5 and Rotates Keys Online #

The release adds a new AES256KRB5 CephX cipher and makes it the default cipher, replacing weaker legacy key types. It also adds online key rotation for mon, OSD and MDS daemons during upgrades. Because the default changes, review the key types your cluster uses after the upgrade.

The security list in the same entry names CVE-2025-30156, which it describes as AES-CBC misuse enabling authentication bypass. It also lists fixes for CVE-2026-39944, CVE-2026-50152 and CVE-2026-54330 (pr#71172), without descriptions. The Squid line also carries a related entry: the Ceph.io — v19.2.7 Squid released changelog lists "fix make check / API / cli / qa breakage from the cephx (CVE-2025-30156) merge" (pr#71190), which connects the CVE fix to the test and API breakage it caused in that line.

Presigned PUT Uploads Return with the SigV4 Fix #

The release fixes a regression that rejected requests with an unsigned Content-Type and broke presigned PUT uploads. The v21.2.0 notes place the regression in 19.2.6 and 20.2.4. The same notes state that x-amz-content-sha256 is no longer required in SignedHeaders for S3 requests (pr#71363).

The Squid line, which the Ceph.io — v19.2.7 Squid released notes call the seventh backport release in the Squid series, lists the matching RGW entries. Its notes include "Content-Type is no longer always required to be present in the signature" (pr#71296), and they state that the AWS v4 signer now always includes the x-amz-content-sha256 header when signing (pr#69003). Test presigned PUT clients against both behaviours in your environment.

Monitor RocksDB Backup and Stretch Mode Restrictions #

The new RocksDB backup and restore mechanism is optional. It is controlled by mon_backup_interval, can be started on demand, and is restored offline. The release lists these commands:

ceph tell mon.* backup
ceph-mon --restore-backup

Stretch clusters gain an optional tiebreaker monitor, a max bucket-weight-diff threshold, and a health warning for colocated monitors. The release also restricts changing the election strategy after stretch mode is enabled. Settle the election strategy before enabling stretch mode. This suggests that a change to the strategy after that point is not an available option, so the decision belongs in the planning stage.

The availability score for Monitor and OSD is new and off by default, with a config toggle for its health warnings. Enable it only after you have reviewed those warnings.

ok-to-upgrade Orders OSDs Across CRUSH Buckets #

The mgr DaemonServer change makes ok-to-upgrade aggregate OSDs and globally sort them across CRUSH child buckets. The release says this fixes inaccurate per-chassis and per-rack ordering, and that upgrades can now be scoped to a CRUSH bucket. cephadm uses this for CRUSH bucket-aware upgrades, which the release describes as enabling faster and safe concurrent OSD upgrades while preserving data availability.

This suggests that an upgrade script that depended on per-chassis or per-rack ordering should be checked against the new global order.

Also in this release #

• RGW: full object dedup as tech preview, bucket logging with journal mode and EC-pool support, and cloud restore from Glacier and tape.
• RGW: AES-256-GCM SSE, CopyObject for encrypted objects, and GetAccountSummary with account-wide PublicAccessBlock.
• RGW: removal of the legacy Keystone admin-token requirement, and GetCallerIdentity with JWT/JWKS validation.
• BlueStore: full-device discard on mkfs is now default, and device-type-specific allocation policy is added.
• cephadm: certmgr integration for mgmt-gateway, monitoring, NFS and RGW, and standardized TLS PEM handling.
• CephFS: a FSCrypt userspace implementation and multi-threaded cephfs-mirror.
• Dashboard: migration to the IBM Carbon design system and Angular upgraded to v19.
• Build: Ubuntu 24.04 and Rocky Linux 10 are supported, CMake requires 3.22.1, and the C++ standard is raised to C++23.

Upgrade Verification Checklist #

• Every container host supports the x86-64-v3 microarchitecture level.
• Every host runs Python 3.9 or newer.
• Erasure-coded pools use 4k-aligned chunk sizes, and each Blaum-Roth profile has a prime w+1.
• bluestore_osd_memory_target and the number of OSDs per SSD have been checked against pr#69452.
• mon_target_pg_per_osd and mon_max_pg_per_osd have been reviewed against the pg_num values of autoscaled pools.
• osd_op_num_shards_hdd and osd_op_num_threads_per_shard_hdd have the intended values on HDD OSDs.
• The election strategy was settled before stretch mode was enabled.
• Presigned PUT clients have been tested against RGW.