KVM agent fails to connect to Ceph RBD storage pool after upgrading Ceph client to Tentacle 20.2.4

[wi3dzma]

problem

CloudStack builds its Ceph RBD connection strings with the legacy Ceph option auth_supported=cephx. This option was removed in Ceph Tentacle 20.2.4. As a result, every RBD operation performed by the KVM agent through librados now fails, and the agent cannot bring up the RBD storage pool:

**agent.err:**
libvirt: Storage Driver error : internal error: failed to set RADOS option: auth_supported

**agent.log:**
2026-08-27 00:00:13,468 ERROR [kvm.storage.LibvirtStorageAdaptor] (AgentRequest-Handler-3:[]) (logid:e0478a61) Failed to create RBD storage pool: org.libvirt.LibvirtException: internal error: failed to set RADOS option: auth_supported
2026-08-27 00:00:13,468 ERROR [kvm.storage.LibvirtStorageAdaptor] (AgentRequest-Handler-3:[]) (logid:e0478a61) Failed to create the RBD storage pool, cleaning up the libvirt secret

In ACS Host state is Disconnected

Code:
plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/storage/KVMPhysicalDisk.java, lines 56-62

versions

ACS: 4.22.1.1
Hypervisor OS: KVM on Rocky Linux 9.8
libvirt: 11.10.0
Ceph client packages: librados2 / librbd1 / ceph-common 2:20.2.4-0.el9
Ceph cluster: 20.2.4 Tentacle

The steps to reproduce the bug

1. Deploy a KVM host with Ceph RBD primary storage and cephx enabled.
2. Upgrade the Ceph client packages on the KVM host to 20.2.4 (Tentacle): librados2, librbd1, ceph-common.
3. Restart libvirtd and cloudstack-agent.

What to do about it?

Remove auth_supported, it is redundant. When id and key are supplied, the client negotiates cephx anyway, and when they are not, it falls back to whatever auth_client_required in ceph.conf specifies.
It is also possible to use auth_client_required instead of auth_supported.

[weizhouapache]

thanks @wi3dzma
added to 4.22.2 milestone

[MitchDrage]

I ran into this same issue rebuilding my lab. For now we're just holding our KVM hosts on Ceph 20.2.2.
Anyone building a fresh CS install with Ceph Tentacle (latest) is going to hit this issue.

RE: PR #13991 - while it is required, I don't think the PR fixes this on its own.
The PR fixes the qemu-img operations (template copy to primary, volume copies, snapshot backup) so it is necessary, but there's also the error in the log above coming from libvirt.
That libvirt log is where libvirt's RBD storage backend sets auth_supported itself when it opens the connection for the pool, so the connection to the storage pool will still fail on a 20.2.4 client with the PR applied. As far as I can see libvirt hasn't fixed this yet and Ceph hasn't reverted the removal.

Proxmox ran into the same thing (https://bugzilla.proxmox.com/show_bug.cgi?id=7961) and ended up putting the option back in their own Ceph build rather than waiting on upstream.

So #13991 is still needed for the qemu-img side, but this issue probably needs to stay open until libvirt catches up.
Not sure if there's anything else that should be done communications wise - as there will be deployments failing if people are just using cepf-tentacle (latest).