[unholy-bot]

This PR contains the following updates:

Package	Update	Change
quay.io/ceph/ceph	major	v20.2.5 → v21.2.0

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Configuration

📅 Schedule: (in timezone Australia/Melbourne)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[unholy-bot]

diff -ruN base/CephCluster_rook-ceph_rook-ceph.yml pr/CephCluster_rook-ceph_rook-ceph.yml
--- base/CephCluster_rook-ceph_rook-ceph.yml
+++ pr/CephCluster_rook-ceph_rook-ceph.yml
@@ -17,7 +17,7 @@
       osd_class_update_on_start: "false"
   cephVersion:
     allowUnsupported: false
-    image: quay.io/ceph/ceph:v20.2.5
+    image: quay.io/ceph/ceph:v21.2.0
   cleanupPolicy:
     allowUninstallWithVolumes: false
     confirmation: ""
diff -ruN base/ConfigMap_rook-ceph_rook-ceph-cluster-values-467t2c698d.yml pr/ConfigMap_rook-ceph_rook-ceph-cluster-values-467t2c698d.yml
--- base/ConfigMap_rook-ceph_rook-ceph-cluster-values-467t2c698d.yml
+++ pr/ConfigMap_rook-ceph_rook-ceph-cluster-values-467t2c698d.yml
@@ -1,216 +0,0 @@
----
-apiVersion: v1
-data:
-  values.yaml: |
-    monitoring:
-      enabled: true
-      createPrometheusRules: true
-    toolbox:
-      enabled: true
-    # Pin the Ceph image via the chart's dedicated cephImage value (NOT cephClusterSpec.cephVersion,
-    # which the chart forbids and which double-renders cephVersion -> post-render failure). The chart's
-    # default cephImage.tag drove an unintended squid v19.2.3 -> tentacle v20.2.4 major on the 1.19->1.20
-    # hop (2026-09-15); require_osd_release is now tentacle, so downgrade is impossible. Pin so future
-    # chart bumps never drift the Ceph major again -- Ceph upgrades must be deliberate, one major at a time.
-    cephImage:
-      repository: quay.io/ceph/ceph
-      tag: v20.2.5
-      allowUnsupported: false
-    cephClusterSpec:
-      security:
-        cephx:
-          # CVE-2025-30156 hardening: every cephx key is aes256k (`ceph auth dump-keys`
-          # shows no aes key since 2026-11-04), so mons only accept aes256k. Rollback
-          # if a client can't authenticate: [aes, aes256k].
-          allowedCiphers: [aes256k]
-          # Daemon keys (mon/mgr/osd/mds) rotated 2026-09-15. No daemon keyType here:
-          # Rook auto-detects aes256k, and setting one makes Rook start every mon with
-          # --mon-auth-emergency-allowed-ciphers=aes,aes256k (AUTH_EMERGENCY_CIPHERS_SET).
-          daemon:
-            keyRotationPolicy: KeyGeneration
-            keyGeneration: 2
-          # Upstream aes256k needs kernel >= 7.0, but Talos 1.14 backports it to 6.18
-          # (siderolabs/pkgs "backport aes256k support (Ceph)"). Proven 2026-11-04 with
-          # an aes256k kernel CephFS mount on every node. Rotated keys only apply to new
-          # mounts, so a future rotation needs keepPriorKeyCountMax: 1 until every node
-          # has been drained (no `ceph tell mon.* sessions` entry on the old generation),
-          # then 0. The aes .1 generation was dropped 2026-11-04 after the Talos 1.14.5
-          # rolling upgrade remounted every volume with the .2 keys.
-          csi:
-            keyRotationPolicy: KeyGeneration
-            keyGeneration: 2
-            keepPriorKeyCountMax: 0
-            keyType: aes256k
-          # No pool has mirroring configured; rotated so no aes key is left.
-          rbdMirrorPeer:
-            keyRotationPolicy: KeyGeneration
-            keyGeneration: 2
-            keyType: aes256k
-      cephConfig:
-        global:
-          bdev_enable_discard: "true" # quote
-          bdev_async_discard_threads: "1" # quote
-          osd_class_update_on_start: "false" # quote
-          device_failure_prediction_mode: local # requires mgr module
-          # Persist the audit channel (osd blocklist add etc.) in mon pod logs;
-          # it is otherwise written nowhere (RCA 2026-09-10).
-          mon_cluster_log_to_stderr: "true" # quote
-      cleanupPolicy:
-        wipeDevicesFromOtherClusters: true
-      crashCollector:
-        disable: false
-      csi:
-        readAffinity:
-          enabled: true
-        # requireMsgr2 is on, so kernel CephFS mounts need an msgr2 mode. Was the
-        # operator's csi.cephFSKernelMountOptions, which stopped being read in 1.20;
-        # the live ClientProfile only kept it as a leftover from the 1.19 migration.
-        cephfs:
-          kernelMountOptions: ms_mode=prefer-crc
-      priorityClassNames:
-        mon: platform-node-critical
-        osd: platform-node-critical
-        mgr: platform-cluster-critical
-      resources:
-        mon:
-          requests:
-            cpu: 250m
-            memory: 1Gi
-          limits:
-            memory: 2Gi
-        mgr:
-          requests:
-            cpu: 250m
-            memory: 512Mi
-          limits:
-            memory: 2Gi
-        osd:
-          # Request matches default osd_memory_target (4 GiB); limit gives headroom for
-          # backfill/recovery and bootstrap, where Ceph routinely doubles working set.
-          requests:
-            cpu: 500m
-            memory: 4Gi
-          limits:
-            memory: 8Gi
-      dashboard:
-        enabled: true
-        urlPrefix: /
-        ssl: false
-        prometheusEndpoint: http://prometheus-operated.observability.svc.cluster.local:9090
-      mgr:
-        modules:
-          - name: diskprediction_local
-            enabled: true
-          - name: insights
-            enabled: true
-          - name: pg_autoscaler
-            enabled: true
-          # Upstream recommends disabling it on Tentacle (known stability issues); the
-          # only effect is a few unused Ceph dashboard pages. Chart default since 1.21.
-          - name: rook
-            enabled: false
-      network:
-        connections:
-          requireMsgr2: true
-      storage:
-        useAllNodes: true
-        useAllDevices: false
-        devicePathFilter: /dev/disk/by-id/nvme-Micron_7450_MTFDKBA960TFR_.*
-        config:
-          osdsPerDevice: "1"
-    cephBlockPools:
-      - name: ceph-blockpool
-        spec:
-          failureDomain: host
-          replicated:
-            size: 3
-        storageClass:
-          enabled: true
-          name: ceph-block
-          isDefault: true
-          reclaimPolicy: Delete
-          allowVolumeExpansion: true
-          volumeBindingMode: Immediate
-          mountOptions:
-            - discard
-          parameters:
-            compression_mode: aggressive
-            compression_algorithm: zstd
-            imageFormat: "2"
-            imageFeatures: layering,fast-diff,object-map,deep-flatten,exclusive-lock
-            # One kernel client per image instead of one shared client per node:
-            # an exclusive-lock break blocklists only that image's client, not
-            # every RBD volume on the node (RCA 2026-09-10). Applies to PVs
-            # provisioned after this change (mapOptions live in PV volumeAttributes).
-            mapOptions: "krbd:noshare"
-            csi.storage.k8s.io/provisioner-secret-name: rook-csi-rbd-provisioner
-            csi.storage.k8s.io/provisioner-secret-namespace: "{{ .Release.Namespace }}"
-            csi.storage.k8s.io/controller-expand-secret-name: rook-csi-rbd-provisioner
-            csi.storage.k8s.io/controller-expand-secret-namespace: "{{ .Release.Namespace }}"
-            csi.storage.k8s.io/node-stage-secret-name: rook-csi-rbd-node
-            csi.storage.k8s.io/node-stage-secret-namespace: "{{ .Release.Namespace }}"
-            csi.storage.k8s.io/fstype: ext4
-    cephBlockPoolsVolumeSnapshotClass:
-      enabled: true
-      name: csi-ceph-blockpool
-      isDefault: false
-      deletionPolicy: Delete
-    cephFileSystems:
-      - name: &cephFileSystemName ceph-filesystem
-        spec:
-          metadataPool:
-            replicated:
-              size: 3
-          dataPools:
-            - failureDomain: host
-              replicated:
-                size: 3
-              name: data0
-          metadataServer:
-            activeCount: 1
-            activeStandby: true
-            priorityClassName: platform-cluster-critical
-            placement:
-              topologySpreadConstraints:
-                - maxSkew: 1
-                  topologyKey: kubernetes.io/hostname
-                  whenUnsatisfiable: DoNotSchedule
-                  labelSelector:
-                    matchLabels:
-                      app.kubernetes.io/name: ceph-mds
-                      app.kubernetes.io/part-of: *cephFileSystemName
-            resources:
-              requests:
-                cpu: 100m
-                memory: 1Gi
-              limits:
-                memory: 4Gi
-        storageClass:
-          enabled: true
-          isDefault: false
-          name: ceph-filesystem
-          pool: data0
-          reclaimPolicy: Delete
-          allowVolumeExpansion: true
-          volumeBindingMode: Immediate
-          parameters:
-            csi.storage.k8s.io/provisioner-secret-name: rook-csi-cephfs-provisioner
-            csi.storage.k8s.io/provisioner-secret-namespace: "{{ .Release.Namespace }}"
-            csi.storage.k8s.io/controller-expand-secret-name: rook-csi-cephfs-provisioner
-            csi.storage.k8s.io/controller-expand-secret-namespace: "{{ .Release.Namespace }}"
-            csi.storage.k8s.io/node-stage-secret-name: rook-csi-cephfs-node
-            csi.storage.k8s.io/node-stage-secret-namespace: "{{ .Release.Namespace }}"
-            csi.storage.k8s.io/fstype: ext4
-    cephFileSystemVolumeSnapshotClass:
-      enabled: true
-      name: csi-ceph-filesystem
-      isDefault: false
-      deletionPolicy: Delete
-    cephObjectStores: []
-kind: ConfigMap
-metadata:
-  labels:
-    kustomize.toolkit.fluxcd.io/name: rook-ceph-cluster
-    kustomize.toolkit.fluxcd.io/namespace: rook-ceph
-  name: rook-ceph-cluster-values-467t2c698d
-  namespace: rook-ceph
diff -ruN base/ConfigMap_rook-ceph_rook-ceph-cluster-values-hb5982f9cc.yml pr/ConfigMap_rook-ceph_rook-ceph-cluster-values-hb5982f9cc.yml
--- base/ConfigMap_rook-ceph_rook-ceph-cluster-values-hb5982f9cc.yml
+++ pr/ConfigMap_rook-ceph_rook-ceph-cluster-values-hb5982f9cc.yml
@@ -0,0 +1,216 @@
+---
+apiVersion: v1
+data:
+  values.yaml: |
+    monitoring:
+      enabled: true
+      createPrometheusRules: true
+    toolbox:
+      enabled: true
+    # Pin the Ceph image via the chart's dedicated cephImage value (NOT cephClusterSpec.cephVersion,
+    # which the chart forbids and which double-renders cephVersion -> post-render failure). The chart's
+    # default cephImage.tag drove an unintended squid v19.2.3 -> tentacle v20.2.4 major on the 1.19->1.20
+    # hop (2026-09-15); require_osd_release is now tentacle, so downgrade is impossible. Pin so future
+    # chart bumps never drift the Ceph major again -- Ceph upgrades must be deliberate, one major at a time.
+    cephImage:
+      repository: quay.io/ceph/ceph
+      tag: v21.2.0
+      allowUnsupported: false
+    cephClusterSpec:
+      security:
+        cephx:
+          # CVE-2025-30156 hardening: every cephx key is aes256k (`ceph auth dump-keys`
+          # shows no aes key since 2026-11-04), so mons only accept aes256k. Rollback
+          # if a client can't authenticate: [aes, aes256k].
+          allowedCiphers: [aes256k]
+          # Daemon keys (mon/mgr/osd/mds) rotated 2026-09-15. No daemon keyType here:
+          # Rook auto-detects aes256k, and setting one makes Rook start every mon with
+          # --mon-auth-emergency-allowed-ciphers=aes,aes256k (AUTH_EMERGENCY_CIPHERS_SET).
+          daemon:
+            keyRotationPolicy: KeyGeneration
+            keyGeneration: 2
+          # Upstream aes256k needs kernel >= 7.0, but Talos 1.14 backports it to 6.18
+          # (siderolabs/pkgs "backport aes256k support (Ceph)"). Proven 2026-11-04 with
+          # an aes256k kernel CephFS mount on every node. Rotated keys only apply to new
+          # mounts, so a future rotation needs keepPriorKeyCountMax: 1 until every node
+          # has been drained (no `ceph tell mon.* sessions` entry on the old generation),
+          # then 0. The aes .1 generation was dropped 2026-11-04 after the Talos 1.14.5
+          # rolling upgrade remounted every volume with the .2 keys.
+          csi:
+            keyRotationPolicy: KeyGeneration
+            keyGeneration: 2
+            keepPriorKeyCountMax: 0
+            keyType: aes256k
+          # No pool has mirroring configured; rotated so no aes key is left.
+          rbdMirrorPeer:
+            keyRotationPolicy: KeyGeneration
+            keyGeneration: 2
+            keyType: aes256k
+      cephConfig:
+        global:
+          bdev_enable_discard: "true" # quote
+          bdev_async_discard_threads: "1" # quote
+          osd_class_update_on_start: "false" # quote
+          device_failure_prediction_mode: local # requires mgr module
+          # Persist the audit channel (osd blocklist add etc.) in mon pod logs;
+          # it is otherwise written nowhere (RCA 2026-09-10).
+          mon_cluster_log_to_stderr: "true" # quote
+      cleanupPolicy:
+        wipeDevicesFromOtherClusters: true
+      crashCollector:
+        disable: false
+      csi:
+        readAffinity:
+          enabled: true
+        # requireMsgr2 is on, so kernel CephFS mounts need an msgr2 mode. Was the
+        # operator's csi.cephFSKernelMountOptions, which stopped being read in 1.20;
+        # the live ClientProfile only kept it as a leftover from the 1.19 migration.
+        cephfs:
+          kernelMountOptions: ms_mode=prefer-crc
+      priorityClassNames:
+        mon: platform-node-critical
+        osd: platform-node-critical
+        mgr: platform-cluster-critical
+      resources:
+        mon:
+          requests:
+            cpu: 250m
+            memory: 1Gi
+          limits:
+            memory: 2Gi
+        mgr:
+          requests:
+            cpu: 250m
+            memory: 512Mi
+          limits:
+            memory: 2Gi
+        osd:
+          # Request matches default osd_memory_target (4 GiB); limit gives headroom for
+          # backfill/recovery and bootstrap, where Ceph routinely doubles working set.
+          requests:
+            cpu: 500m
+            memory: 4Gi
+          limits:
+            memory: 8Gi
+      dashboard:
+        enabled: true
+        urlPrefix: /
+        ssl: false
+        prometheusEndpoint: http://prometheus-operated.observability.svc.cluster.local:9090
+      mgr:
+        modules:
+          - name: diskprediction_local
+            enabled: true
+          - name: insights
+            enabled: true
+          - name: pg_autoscaler
+            enabled: true
+          # Upstream recommends disabling it on Tentacle (known stability issues); the
+          # only effect is a few unused Ceph dashboard pages. Chart default since 1.21.
+          - name: rook
+            enabled: false
+      network:
+        connections:
+          requireMsgr2: true
+      storage:
+        useAllNodes: true
+        useAllDevices: false
+        devicePathFilter: /dev/disk/by-id/nvme-Micron_7450_MTFDKBA960TFR_.*
+        config:
+          osdsPerDevice: "1"
+    cephBlockPools:
+      - name: ceph-blockpool
+        spec:
+          failureDomain: host
+          replicated:
+            size: 3
+        storageClass:
+          enabled: true
+          name: ceph-block
+          isDefault: true
+          reclaimPolicy: Delete
+          allowVolumeExpansion: true
+          volumeBindingMode: Immediate
+          mountOptions:
+            - discard
+          parameters:
+            compression_mode: aggressive
+            compression_algorithm: zstd
+            imageFormat: "2"
+            imageFeatures: layering,fast-diff,object-map,deep-flatten,exclusive-lock
+            # One kernel client per image instead of one shared client per node:
+            # an exclusive-lock break blocklists only that image's client, not
+            # every RBD volume on the node (RCA 2026-09-10). Applies to PVs
+            # provisioned after this change (mapOptions live in PV volumeAttributes).
+            mapOptions: "krbd:noshare"
+            csi.storage.k8s.io/provisioner-secret-name: rook-csi-rbd-provisioner
+            csi.storage.k8s.io/provisioner-secret-namespace: "{{ .Release.Namespace }}"
+            csi.storage.k8s.io/controller-expand-secret-name: rook-csi-rbd-provisioner
+            csi.storage.k8s.io/controller-expand-secret-namespace: "{{ .Release.Namespace }}"
+            csi.storage.k8s.io/node-stage-secret-name: rook-csi-rbd-node
+            csi.storage.k8s.io/node-stage-secret-namespace: "{{ .Release.Namespace }}"
+            csi.storage.k8s.io/fstype: ext4
+    cephBlockPoolsVolumeSnapshotClass:
+      enabled: true
+      name: csi-ceph-blockpool
+      isDefault: false
+      deletionPolicy: Delete
+    cephFileSystems:
+      - name: &cephFileSystemName ceph-filesystem
+        spec:
+          metadataPool:
+            replicated:
+              size: 3
+          dataPools:
+            - failureDomain: host
+              replicated:
+                size: 3
+              name: data0
+          metadataServer:
+            activeCount: 1
+            activeStandby: true
+            priorityClassName: platform-cluster-critical
+            placement:
+              topologySpreadConstraints:
+                - maxSkew: 1
+                  topologyKey: kubernetes.io/hostname
+                  whenUnsatisfiable: DoNotSchedule
+                  labelSelector:
+                    matchLabels:
+                      app.kubernetes.io/name: ceph-mds
+                      app.kubernetes.io/part-of: *cephFileSystemName
+            resources:
+              requests:
+                cpu: 100m
+                memory: 1Gi
+              limits:
+                memory: 4Gi
+        storageClass:
+          enabled: true
+          isDefault: false
+          name: ceph-filesystem
+          pool: data0
+          reclaimPolicy: Delete
+          allowVolumeExpansion: true
+          volumeBindingMode: Immediate
+          parameters:
+            csi.storage.k8s.io/provisioner-secret-name: rook-csi-cephfs-provisioner
+            csi.storage.k8s.io/provisioner-secret-namespace: "{{ .Release.Namespace }}"
+            csi.storage.k8s.io/controller-expand-secret-name: rook-csi-cephfs-provisioner
+            csi.storage.k8s.io/controller-expand-secret-namespace: "{{ .Release.Namespace }}"
+            csi.storage.k8s.io/node-stage-secret-name: rook-csi-cephfs-node
+            csi.storage.k8s.io/node-stage-secret-namespace: "{{ .Release.Namespace }}"
+            csi.storage.k8s.io/fstype: ext4
+    cephFileSystemVolumeSnapshotClass:
+      enabled: true
+      name: csi-ceph-filesystem
+      isDefault: false
+      deletionPolicy: Delete
+    cephObjectStores: []
+kind: ConfigMap
+metadata:
+  labels:
+    kustomize.toolkit.fluxcd.io/name: rook-ceph-cluster
+    kustomize.toolkit.fluxcd.io/namespace: rook-ceph
+  name: rook-ceph-cluster-values-hb5982f9cc
+  namespace: rook-ceph
diff -ruN base/Deployment_rook-ceph_rook-ceph-tools.yml pr/Deployment_rook-ceph_rook-ceph-tools.yml
--- base/Deployment_rook-ceph_rook-ceph-tools.yml
+++ pr/Deployment_rook-ceph_rook-ceph-tools.yml
@@ -161,7 +161,7 @@
                 secretKeyRef:
                   key: ceph-username
                   name: rook-ceph-mon
-          image: quay.io/ceph/ceph:v20.2.5
+          image: quay.io/ceph/ceph:v21.2.0
           imagePullPolicy: IfNotPresent
           name: rook-ceph-tools
           resources:
diff -ruN base/HelmRelease_rook-ceph_rook-ceph-cluster.yml pr/HelmRelease_rook-ceph_rook-ceph-cluster.yml
--- base/HelmRelease_rook-ceph_rook-ceph-cluster.yml
+++ pr/HelmRelease_rook-ceph_rook-ceph-cluster.yml
@@ -39,4 +39,4 @@
       strategy: rollback
   valuesFrom:
     - kind: ConfigMap
-      name: rook-ceph-cluster-values-467t2c698d
+      name: rook-ceph-cluster-values-hb5982f9cc

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	k8s-gitops	d34aed0	Commit Preview URL Branch Preview URL	Nov 07 2026, 02:05 PM