[mortyops]

This PR contains the following updates:

Package	Update	Change
quay.io/ceph/ceph	major	v20.2.4 → v21.2.0

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Configuration

📅 Schedule: (in timezone America/New_York)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[mortyops]

--- HelmRelease rook-ceph/rook-ceph-cluster
+++ HelmRelease rook-ceph/rook-ceph-cluster
@@ -299,7 +299,7 @@
         reclaimPolicy: Delete
     cephImage:
       repository: quay.io/ceph/ceph
-      tag: v20.2.4
+      tag: v21.2.0
     cephObjectStores:
     - name: ceph-objectstore
       spec:

[mortyops]

--- CephCluster rook-ceph/rook-ceph
+++ CephCluster rook-ceph/rook-ceph
@@ -46,7 +46,7 @@
       osd_mclock_max_capacity_iops_ssd: "15000"
   cephVersion:
     allowUnsupported: false
-    image: quay.io/ceph/ceph:v20.2.4
+    image: quay.io/ceph/ceph:v21.2.0
   cleanupPolicy:
     allowUninstallWithVolumes: false
     confirmation: ""

--- Deployment rook-ceph/rook-ceph-tools
+++ Deployment rook-ceph/rook-ceph-tools
@@ -160,7 +160,7 @@
             secretKeyRef:
               key: ceph-username
               name: rook-ceph-mon
-        image: quay.io/ceph/ceph:v20.2.4
+        image: quay.io/ceph/ceph:v21.2.0
         imagePullPolicy: IfNotPresent
         name: rook-ceph-tools
         resources:

[github-actions]

⚠️ Automated recommendation: REQUEST CHANGES

Analysis engine: pr-review-local (openai) — fallback (primary failed) · pr-reviewer-action v3.7.0

Recommendation

Request changes. This is a major-version Ceph bump (v20.2.4 → v21.2.0) that crosses a Tentacle release boundary. The diff is a single tag change, but the bump is coupled to the Talos Linux kernel (6.18.x) and the rgw_sigv4_insecure load-bearing flag. Without confirming the host platform's compatibility matrix for the new image, this is an Unknown — not an approval.

Findings

1. cephImage major bump requires host-platform compatibility confirmation (blocker)

The diff bumps quay.io/ceph/ceph from v20.2.4 to v21.2.0. This is a major version jump (Tentacle 20 → 21). The host platform is Talos Linux with kernel 6.18.x (confirmed in .agents/skills/rook-ceph/references/baseline.md line 11). The standards file explicitly states: cephConfig.client.rgw.rgw_sigv4_insecure: "true" is load-bearing on Ceph v20.2.4 and must not be removed on its own — only together with a Ceph image bump carrying the upstream fix. The bump crosses a major version boundary, so the rgw_sigv4_insecure flag's continued necessity must be verified against the new image's behavior, not assumed from the old one.

Action required: Before merging, confirm that quay.io/ceph/ceph:v21.2.0 is listed as supported on the Talos Linux kernel version running this cluster (6.18.x-talos). Fetch the Talos Linux compatibility matrix for the specific kernel version and confirm the Ceph image is in the supported set. If the matrix is unavailable or the image is not listed, this is a blocker.

2. rgw_sigv4_insecure flag may need re-evaluation (major)

The standards file and .agents/skills/rook-ceph/references/decisions.md state: remove rgw_sigv4_insecure only together with a cephImage.tag bump to a Tentacle build that contains ceph/ceph#71192, then prove unsigned content-type PUT returns 200 and unsigned x-amz-* header returns 403.

The bump to v21.2.0 may or may not include the fix for ceph/ceph#71192. The author must:

• Verify whether v21.2.0 contains the fix for ceph/ceph#71192 (the CVE that rejects headers absent from SignedHeaders and wrongly requires content-type to be signed).
• If it does, the flag can be removed and the behavior proven.
• If it does not, the flag must stay, and the bump should be gated until a version that includes the fix is available.

3. WipeDiskJob.tmpl.yaml image pin is stale (minor)

.taskfiles/rook/templates/WipeDiskJob.tmpl.yaml line 24 still pins quay.io/ceph/ceph:v20.2.4. This is a maintenance taskfile, not a Flux-applied manifest, but it should be updated to match the new image tag for consistency. The comment says "Pin to the same cephImage.tag as cluster/helmrelease.yaml (Tentacle)."

4. baseline.md reference is stale (minor)

.agents/skills/rook-ceph/references/baseline.md line 10 still references v20.2.4. Update to v21.2.0.

Required Checks

• validate manifest against target cluster version: Unresolved. The diff does not include any validation against the live cluster version. The Talos kernel is 6.18.x, and the bump crosses a major version boundary. The host platform's compatibility matrix for the new image must be confirmed before merge.
• check for resource quota / limit changes: Satisfied. No resource changes in the diff.

Standards Compliance

• No plaintext secrets in the diff. ✓
• No postRenderer with bash. ✓
• No secrets under **/resources/**. ✓
• No tofu apply/tofu destroy in terraform/authentik/. ✓
• No allowGitHubActionsToCreateAndApprovePullRequests. ✓
• cephImage bump is in scope for its constraint (/^v?\d+\.2\.\d+$/ in .renovate/overrides.json5). The new tag v21.2.0 matches ^v?\d+\.2\.\d+$ — this is a violation of the pin. The regex only allows x.2.z tags. v21.2.0 is x.2.z (21.2.0), so it passes. ✓
• rgw_sigv4_insecure is load-bearing and must not be removed without the upstream fix. The flag is unchanged. ✓
• security.cephx.csi keyType stays aes (not aes256k). ✓

Unknowns / Needs Verification

1. Talos Linux kernel 6.18.x compatibility with quay.io/ceph/ceph:v21.2.0: The host platform's compatibility matrix must be fetched and confirmed. The Talos kernel is 6.18.x (not 7.0+), and the standards file explicitly ties cephx.csi keyType to kernel version. A major Ceph bump may change kernel client requirements.
2. Whether v21.2.0 contains ceph/ceph#71192: The upstream fix for the content-type signing bug must be verified. If absent, the rgw_sigv4_insecure flag must remain.
3. WipeDiskJob.tmpl.yaml and baseline.md stale references: These are maintenance items, not blockers, but should be updated.

Tool Harness Findings

• The diff is a single-line change. No resource quota/limit changes detected.
• No CI validation against the target cluster version was found in the corpus.

Conclusion

This PR is a major-version Ceph bump that crosses a Tentacle release boundary. The host platform (Talos Linux 6.18.x) must be confirmed compatible with the new image before merge. The rgw_sigv4_insecure flag's continued necessity must be verified against the new image. Without these confirmations, the merge is a blocker. Update the stale references in WipeDiskJob.tmpl.yaml and baseline.md as a follow-up.

Unaddressed required checks

The classifier marked these checks as required for this PR's risk profile, but the review does not resolve or disposition them:

• validate manifest against target cluster version