feat(container)!: Update image quay.io/ceph/ceph (v20.2.4 ➔ v21.1.0)

[renovate]

This PR contains the following updates:

Package	Update	Change
quay.io/ceph/ceph	major	v20.2.4 → v21.1.0

---

Configuration

📅 Schedule: (in timezone Europe/Brussels)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[tanguille-cluster]

@@ spec.template.spec.containers.rook-ceph-tools.image @@
# apps/v1/Deployment/rook-ceph/rook-ceph-tools
! ± value change
- quay.io/ceph/ceph:v20.2.4@sha256:6bb1c8a42fbc0bf87938946990b65174466997bc11c31eb5a323225a779fd8f9
+ quay.io/ceph/ceph:v21.1.0@sha256:5ff3692d2f3f4bf47ca7717de6f8f8556440ce3e15efaa680b62cb924eec0541

@@ spec.cephVersion.image @@
# ceph.rook.io/v1/CephCluster/rook-ceph/rook-ceph
! ± value change
- quay.io/ceph/ceph:v20.2.4@sha256:6bb1c8a42fbc0bf87938946990b65174466997bc11c31eb5a323225a779fd8f9
+ quay.io/ceph/ceph:v21.1.0@sha256:5ff3692d2f3f4bf47ca7717de6f8f8556440ce3e15efaa680b62cb924eec0541

[tanguille-cluster]

@@ spec.values.cephImage.tag @@
# helm.toolkit.fluxcd.io/v2/HelmRelease/rook-ceph/rook-ceph-cluster
! ± value change
- v20.2.4@sha256:6bb1c8a42fbc0bf87938946990b65174466997bc11c31eb5a323225a779fd8f9
+ v21.1.0@sha256:5ff3692d2f3f4bf47ca7717de6f8f8556440ce3e15efaa680b62cb924eec0541

[github-actions]

AI Automated Review

Analysis engine: omniroute@http://litellm.ai.svc.cluster.local/v1 (openai)

Recommendation: Hold this major Ceph image bump (v20.2.4 → v21.1.0) until compatibility with the pinned Rook chart and the custom Talos kernel is confirmed — the one-line diff is clean, but the surrounding evidence is not.

Change-by-change: The only change is the cephImage.tag in kubernetes/apps/rook-ceph/rook-ceph/cluster/helmrelease.yaml. The file was read in full this run; the rest of the values (cephx ciphers, resources, pools, storage) are untouched.

Must-check items:

• Validate manifest against target cluster version: The HelmRelease (helm.toolkit.fluxcd.io/v2) parses and matches the repo's schema/patterns, but the pinned Rook chart is v1.20.7 (both rook-ceph and rook-ceph-cluster OCIRepositories) and I could not verify that Rook 1.20 supports a Ceph 21 image — Rook typically gates supported Ceph versions per release. Not verified.
• Resource quota / limit changes: None — the diff touches only the image tag; all requests/limits are unchanged. Check satisfied.

Release notes: Upstream Ceph v21.1.0 release notes were not fetched this run, so user-visible, breaking, and security changes are unverified. Note the repo's own history: the custom kernel was built specifically to unlock aes256k (held at Linux 7.1.x after 7.2 broke Cilium), and ceph-csi previously could not read aes256k keys — any Ceph 21 cipher/auth changes interact directly with the security.cephx block in this file.

Tool Harness Findings: File reads confirmed the tag line and the chart pins (v1.20.7 on both OCIRepositories); git greps for other Ceph version references returned no additional coupling points.

Unknowns or Needs Verification:

• Rook chart v1.20.7 ↔ Ceph 21 compatibility matrix — not verified.
• Ceph v21.1.0 release notes, including whether v21.1.0 is a stable release or an RC-series build (Ceph's x.1.z convention) — not verified.
• Whether Ceph 21 changes cephx cipher handling that affects allowedCiphers: ["aes256k"] and the csi keyType — not verified.

Sources: repository files read this run (cluster/helmrelease.yaml, both ocirepository.yaml files); no external matrix or release page fetched.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: 5f99d244-712c-4fe8-ab7c-a72eb42eae14

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

📝 Walkthrough

Walkthrough

The Rook Ceph HelmRelease updates its pinned Ceph container image from v20.2.2 to v21.1.0, including the image digest.

Changes

Rook Ceph image update

Layer / File(s)	Summary
Update pinned Ceph image kubernetes/apps/rook-ceph/rook-ceph/cluster/helmrelease.yaml	The cephImage.tag value is updated from the Ceph v20.2.2 image digest to the v21.1.0 image digest.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Possibly related PRs

• Tanguille/cluster#4238: Updates Rook Ceph versions in the same deployment through different components and files.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the Ceph image update and the target major version upgrade, which matches the primary change.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch renovate/quay.io-ceph-ceph-21.x

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[deepsource-io]

DeepSource Code Review

We reviewed changes in cad4533...401cac7 on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.

See full review on DeepSource ↗

PR Report Card

Overall Grade

Security   Reliability   Complexity   Hygiene

Code Review Summary

Analyzer	Status	Updated (UTC)	Details
JavaScript		Sep 10, 2026 4:27p.m.	Review ↗
Shell		Sep 10, 2026 4:27p.m.	Review ↗

---

Important

AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.

[coderabbitai]

Warning

Your free Security trial is over. An organization admin can activate billing to continue.

[Tanguille]

Holding. Two reasons, both independent of the reviewer findings:

1. v21.1.0 is a release candidate, not stable. Ceph uses x.0.z for dev and x.1.z for RC; the first stable v21 will be 21.2.0. Renovate is tracking the tag stream here without a stability filter.
2. Timing. The cluster is mid-migration on the cephx aes to aes256k cipher (rotation to gen 4 is done, keepPriorKeyCountMax: 1 still retains gen-3 aes keys, and allowedCiphers has not been narrowed yet). Stacking a Ceph major on top of an unfinished auth migration removes the ability to attribute a failure to either one.

Current state for the record: Rook chart v1.20.6, operator reports 20.2.4-0 tentacle, require-osd-release tentacle, 3/3 OSDs on 7f793731f1b39eb4f465e960113d2363c311b964.

The reviewer blockers asking for the Rook support matrix are directionally right, but the version naming in them is garbled (v21 is called Reef in one and Squid in another; v20 is Tentacle, v19 is Squid, Reef is v18). Revisit when 21.2.0 ships and the cephx migration is closed out.

[github-actions]

Inline findings from the automated review (summary in the sticky comment).

[github-actions]

⚠️ Major: Major Ceph image bump to v21.1.0 is not verified against the pinned Rook chart v1.20.7 or upstream release notes; confirm compatibility before merging.

Automated finding from AI PR review.

[github-actions]

Info (question): v21.1.0 follows Ceph's RC-series numbering (x.1.z); confirm this is a stable release rather than a development build before pinning it with a digest.

Automated finding from AI PR review.