Reference
Scope
Look-up facts for Ceph: release and support matrix, feature-by-release table, verified configuration defaults, network ports, CephX capability syntax, security advisories, Rook compatibility, limits, and a hardening checklist. For the "why", see Explanation; for step-by-step tasks, see How-to Guides.
Release and Support Matrix
Ceph ships one named stable release roughly per year (version X.2.Z; X.1.Z are release candidates). The project keeps two stable series active at a time. Dates below come from the upstream doc/releases/releases.yml (checked 2026-09-25).
| Release |
Series |
First GA |
Latest point release |
Upstream EOL |
Status (2026-09) |
| Umbrella |
v21 |
TBD |
21.1.x release candidates |
TBD |
In development (RC stage) |
| Tentacle |
v20.2 |
2025-11-18 |
20.2.4 (2026-08-19) |
2027-06-01 (target) |
Active, recommended for new clusters |
| Squid |
v19.2 |
2024-09-26 |
19.2.6 (2026-08-19) |
2026-10-31 (target) |
Active, nearing EOL |
| Reef |
v18.2 |
2023-08-07 |
18.2.8 (2026-03-20) |
2026-03-20 (actual) |
EOL |
| Quincy |
v17.2 |
2022 |
17.2.9 (2025-05-27) |
2025-01-13 (actual) |
EOL |
| Pacific |
v16.2 |
2021 |
16.2.15 |
EOL |
EOL |
Squid EOL date discrepancy
The upstream releases.yml and the Proxmox announcement both give 2026-10-31 as the estimated Squid EOL. At least one secondary source cites 2026-09-19 (unverified). Proxmox's own Ceph Squid repository timeline is tracked in Proxmox Reference. Plan Squid-to-Tentacle upgrades now either way.
Tentacle Point Releases
| Version |
Date |
Highlights |
| 20.2.0 |
2025-11-18 |
FastEC, ISA-L default EC plugin, SMB manager, SeaStore tech preview, mgmt-gateway, certmgr |
| 20.2.1 |
2026-04-06 |
EC recovery fixes; FastEC denied for non-4K-aligned chunk sizes; NVMe-oF fast-failover overhaul; RBD EXCLUSIVE_TRANSIENT lock mode |
| 20.2.2 |
2026-06-16 |
Rocky Linux 10 packages; MDS and PG log fixes |
| 20.2.3 |
2026-08-05 |
New NVMe-oF mgr module (auto-creates .nvmeof pool on fresh installs); RGW ssl_ciphersuites, Kafka mTLS; hardware-monitoring dashboard |
| 20.2.4 |
2026-08-19 |
Security release: CVE-2025-30156, CVE-2026-39944, CVE-2026-50152, CVE-2026-54330 (new aes256k CephX key type) |
Feature Availability by Release
| Feature |
Introduced |
Status (Tentacle 20.2) |
Notes |
| BlueStore default OSD backend |
Luminous (12.2) |
Default |
osd_objectstore = bluestore |
| FileStore |
— |
Removed |
Not supported since Reef (18.2) |
| PG autoscaler on by default |
Octopus (15.2) |
Default |
osd_pool_default_pg_autoscale_mode = on |
| cephadm orchestrator |
Octopus (15.2) |
Recommended installer |
Containers (Podman/Docker) + systemd |
| RocksDB LZ4 compression in BlueStore |
Squid (19.2) |
Default |
Part of bluestore_rocksdb_options |
| RGW User Accounts (IAM APIs) |
Squid (19.2) |
GA |
Tenant-level IAM deprecated in Tentacle |
| Crimson OSD |
Squid (19.2) tech preview |
Tech preview |
Not for production |
| SeaStore object store |
Tentacle (20.2) tech preview |
Tech preview |
NVMe-oriented; deployable with Crimson |
| FastEC (EC optimizations) |
Tentacle (20.2) |
GA, opt-in per pool |
allow_ec_optimizations; cannot be disabled once set |
| ISA-L default EC plugin |
Tentacle (20.2) |
Default for new clusters |
Upgraded clusters keep Jerasure default |
| SMB manager module |
Tentacle (20.2) |
GA |
cephadm-only; Samba + CTDB containers |
| NVMe-oF (NVMe/TCP) gateway |
cephadm nvmeof service in Reef 18.2.x; gateway groups in Squid |
Supported; much expanded in Tentacle |
Multiple namespaces, dashboard, new mgr module (20.2.3) |
| iSCSI gateway |
— |
Maintenance mode since 2022-11 |
Use NVMe-oF or native clients |
mgmt-gateway + oauth2-proxy |
Tentacle (20.2) |
GA |
Single TLS entry point, SSO |
certmgr |
Tentacle (20.2) |
GA |
cephadm-internal CA and rotation |
| Pool data availability score |
Tentacle (20.2) |
Tech preview, off by default |
enable_availability_tracking |
mgr/restful, mgr/zabbix |
— |
Removed in Tentacle |
Use dashboard API / Prometheus |
aes256k CephX key type |
20.2.4 / 19.2.6 |
GA |
Fix for CVE-2025-30156 |
Configuration Defaults
Values checked in the tentacle branch of src/common/options/*.yaml.in (2026-09-25). Values can change between releases; confirm with ceph config help <option>.
| Option |
Default (Tentacle) |
Meaning |
osd_objectstore |
bluestore |
Backend for new OSDs |
osd_pool_default_size |
3 |
Replicas for new replicated pools |
osd_pool_default_min_size |
0 (= size - size/2, so 2 for size 3) |
Minimum replicas to accept I/O |
osd_pool_default_pg_num |
32 |
Initial PGs (autoscaler overrides) |
osd_pool_default_pg_autoscale_mode |
on |
PG autoscaler mode for new pools |
mon_target_pg_per_osd |
100 (main/Umbrella: 200) |
Autoscaler target PG replicas per OSD |
mon_max_pg_per_osd |
250 (main/Umbrella: 500) |
Hard limit; pool creation refused above it |
osd_pool_default_erasure_code_profile |
plugin=isa technique=reed_sol_van k=2 m=2 |
Default EC profile on fresh clusters |
osd_pool_default_flag_ec_optimizations |
false |
Enable FastEC on new EC pools |
osd_op_queue |
mclock_scheduler |
OSD op scheduler |
osd_memory_target |
4 GiB |
Per-OSD memory autotuning target |
bluestore_min_alloc_size_hdd / _ssd |
4 KiB / 4 KiB |
Allocation unit |
bluestore_compression_mode |
none |
Inline data compression off by default |
osd_scrub_min_interval |
1 day |
Light scrub interval |
osd_deep_scrub_interval |
7 days |
Deep scrub interval |
mon_osd_nearfull_ratio / backfillfull / full |
0.85 / 0.90 / 0.95 |
Capacity thresholds |
mon_allow_pool_delete |
false |
Guard against pool deletion |
auth_service_ticket_ttl |
1 hour |
CephX service ticket lifetime |
ms_cluster_mode, ms_service_mode, ms_client_mode |
crc secure |
msgr2 modes, in preference order |
ms_bind_port_min / ms_bind_port_max |
6800 / 7568 |
OSD/MDS/MGR daemon port range |
Network Ports
| Port |
Protocol |
Used by |
| 3300/tcp |
msgr2 |
Monitors (default) |
| 6789/tcp |
msgr1 (legacy) |
Monitors |
| 6800-7568/tcp |
msgr2/msgr1 |
OSD, MDS, MGR daemons (ms_bind_port_min/max) |
| 8443/tcp |
HTTPS |
Ceph Dashboard (mgr module, SSL default) |
| 9283/tcp |
HTTP |
mgr prometheus module exporter |
| 80 or 443/tcp |
HTTP(S) |
RGW deployed by cephadm (default spec) |
| 7480/tcp |
HTTP |
RGW Beast frontend default when run manually |
| 4420/tcp |
NVMe/TCP |
NVMe-oF gateway listeners (NVMe/TCP IANA port) |
Cluster Maps
| Map |
Contents |
View Command |
| Monitor map |
Cluster fsid, monitor addresses, epochs |
ceph mon dump |
| OSD map |
Pools, replica sizes, PG numbers, OSD states |
ceph osd dump |
| PG map |
PG versions, up/acting sets, per-PG state, usage |
ceph pg dump |
| CRUSH map |
Devices, failure-domain hierarchy, rules |
ceph osd getcrushmap / ceph osd crush dump |
| MDS (FS) map |
MDS ranks, metadata pool, active/standby |
ceph fs dump |
Erasure-Code Profiles
Overhead factor is (k+m)/k. Replication 3x has an overhead factor of 3.0 (200% extra).
| Profile |
OSDs needed (min) |
Failures tolerated |
Overhead factor |
Extra raw capacity |
| 2+2 (default profile) |
4 |
2 |
2.0 |
100% |
| 3+2 |
5 |
2 |
1.67 |
67% |
| 4+2 |
6 |
2 |
1.5 |
50% |
| 8+3 |
11 |
3 |
1.375 |
37.5% |
| Replicated size 3 |
3 |
2 |
3.0 |
200% |
FastEC guidance from the upstream EC docs: use a stripe unit of at least 16 KiB with optimizations (default 4 KiB, set at pool creation), keep m <= 3 for block and file workloads, and use the jerasure or isa plugin with reed_sol_van.
CephX Capabilities
| Keyword |
Meaning |
allow |
Precedes access settings. Implies rw for MDS |
r |
Read access |
w |
Write access |
x |
Execute (call class methods, auth operations) |
class-read |
Subset of x. Call class read methods |
class-write |
Subset of x. Call class write methods |
* / all |
Full read, write, execute, and admin permissions |
profile rbd |
Predefined profile for RBD access |
profile osd |
OSD-to-monitor communication |
profile mgr |
Manager daemon |
profile mds |
MDS daemon |
Daemon Keyrings
| Daemon |
Keyring Location |
Required Capabilities |
ceph-mon |
$mon_data/keyring |
mon 'allow *' |
ceph-osd |
$osd_data/keyring |
mgr 'allow profile osd' mon 'allow profile osd' osd 'allow *' |
ceph-mds |
$mds_data/keyring |
mds 'allow' mgr 'allow profile mds' mon 'allow profile mds' osd 'allow rwx' |
ceph-mgr |
$mgr_data/keyring |
mon 'allow profile mgr' mds 'allow *' osd 'allow *' |
radosgw |
$rgw_data/keyring |
mon 'allow rwx' osd 'allow rwx' |
CephX Settings
| Setting |
Scope |
Default |
auth_cluster_required |
Daemon-to-daemon authentication |
cephx |
auth_service_required |
Client-to-daemon authentication |
cephx |
auth_client_required |
Daemon-to-client authentication |
cephx |
auth_allowed_ciphers (mon map) |
Key types accepted |
aes,aes256k after upgrade to 20.2.4/19.2.6 |
auth_preferred_cipher (mon map) |
Key type for new keys |
aes256k on fresh installs; aes on upgraded clusters until changed |
auth_service_cipher (mon map) |
Rotating service key cipher |
Set to aes256k during migration |
CephX Migration Health Checks
| Health check |
Cleared by |
AUTH_INSECURE_SERVICE_KEY_TYPE |
Rotating mon/mgr/osd/mds keys to aes256k |
AUTH_INSECURE_SERVICE_TICKETS |
ceph mon set auth_service_cipher aes256k |
AUTH_INSECURE_ROTATING_SERVICE_KEY_TYPE |
Letting rotating keys expire (or wiping them) |
AUTH_INSECURE_KEYS_CREATABLE |
mon_auth_allow_insecure_key = false or dropping aes from allowed ciphers |
AUTH_INSECURE_CLIENT_KEY_TYPE |
Rotating every client.* key |
Security Advisories
| Published |
CVE |
Severity |
Summary |
Fixed in |
| 2026-08-19 |
CVE-2025-30156 |
High (CVSS 8.9) |
CephX authentication bypass (unauthenticated AES-CBC, fixed IV) |
20.2.4, 19.2.6 |
| 2026-08-19 |
CVE-2026-39944 |
High |
RGW STS session-token bit-flip privilege escalation |
20.2.4, 19.2.6 |
| 2026-08-19 |
CVE-2026-50152 |
High |
Monitor config-key store unauthorized read |
20.2.4, 19.2.6 |
| 2026-08-19 |
CVE-2026-54330 |
High |
RGW SigV4 header injection escalation |
20.2.4, 19.2.6 |
| 2023-02-02 |
CVE-2023-46159 |
Medium |
RGW denial of service |
See upstream |
| 2021-04-14 |
CVE-2021-20288 |
High |
Unauthorized global_id reuse in CephX |
See upstream |
No fixes for EOL releases
The August 2026 fixes shipped only for Tentacle and Squid. Reef and older are EOL and remain vulnerable. Kernel RBD/CephFS clients need Linux 7.0+ (or a vendor backport, for example CentOS Stream 9/10) to use aes256k keys.
Rook Compatibility
| Rook |
Status (2026-09) |
Supported Ceph |
Kubernetes |
Default Ceph image |
| v1.21 |
Beta (v1.21.0-beta.0) |
Squid, Tentacle |
v1.32 to v1.37 |
quay.io/ceph/ceph:v20.2.4 |
| v1.20.7 |
Current stable (v1.20 released 2026-06) |
Squid, Tentacle |
v1.31 to v1.37 |
quay.io/ceph/ceph:v20.2.4 |
Rook v1.20 makes the Ceph-CSI operator the only supported way to configure the CSI drivers. Rook v1.21 will require msgr2 by default (kernel 5.11+; opt out with network.connections.requireMsgr2: false). Umbrella (v21) will need allowUnsupported: true on Rook v1.20.
NVMe-oF Gateway Limits
| Item |
Limit (upstream docs) |
| Gateway groups per cluster |
4 |
| Gateways per group |
8 |
| HA model |
Active/standby per namespace, one load-balancing group per gateway |
| Minimum for HA |
2 gateways plus listeners on every gateway |
| Recommended initiator reconnect window |
1800 seconds (connect-all) |
| Dimension |
Value |
Source |
| Largest published test cluster |
>10,000 OSDs (CERN "Big Bang III", Luminous RC) |
Ceph blog: New in Luminous, improved scalability |
| Earlier CERN test |
30 PB on 7,200 OSDs (2015) |
Same |
| Total capacity |
Exabyte-scale deployments reported |
Vendor and community reports (not independently verified) |
| Objects per PG |
No hard limit |
Upstream docs |
The following ranges are rough, unsourced estimates kept for orientation only. They have no documented hardware, version, or methodology. Run rados bench and fio on your own hardware for planning.
| Operation |
3 OSD (HDD) |
3 OSD (SSD) |
12 OSD (NVMe) |
| Seq write |
300-500 MB/s |
1-2 GB/s |
5-10 GB/s |
| Seq read |
400-600 MB/s |
1.5-3 GB/s |
8-15 GB/s |
| Random 4K write |
500-1,000 IOPS |
10k-30k IOPS |
100k+ IOPS |
| Random 4K read |
1,000-2,000 IOPS |
20k-50k IOPS |
200k+ IOPS |
| RBD block size |
Throughput |
IOPS |
Latency (P99) |
| 4K random |
N/A |
10k-50k |
1-5 ms |
| 64K sequential |
500 MB/s-2 GB/s |
N/A |
2-10 ms |
| 1M sequential |
1-5 GB/s |
N/A |
5-20 ms |
Hardening Checklist
Sources