Arch Linux User Repository

For future commenters:

TLDR:

https://aur.archlinux.org/pkgbase/ceph | From source build (slow)

https://aur.archlinux.org/pkgbase/ceph-bin | Pre-built binaries (fast)

Unlike the original community version, this repo builds ceph from source. Ceph is a large, complicated project so this takes several hours on a good build server.

To get a similar experience to how community/ceph worked (pre-built binaries) use ceph-bin instead.

I can take a look at splitting it out into its own package in .5-1

It's not right, that ceph-exporter merged in ceph-mgr package. The ceph-exporter actually read's UNIX sockets of other ceph daemons, then exports as Prometheus metrics via HTTP interface. I mean, the exporter may be installed on hosts, where mgr should not be installed

Ceph v20.2.4 is now available. This is a security patch, and I recommend anyone that has a Ceph cluster publicly exposed to update as quickly as you can.

Please read:

• The release notes: https://ceph.io/en/news/blog/2026/v20-2-4-v19-2-6-combo-released/
• The procedure for rotating Cephx keys: https://docs.ceph.com/en/latest/rados/configuration/auth-config-ref/index.html#upgrading-and-rotating-cephx-keys

When you update your cluster will enter a HEALTH_ERR state. This is expected.

Beyond that, I recommend reading the Ceph mailing list thread(s) about this release -- a couple good ones:

• https://lists.ceph.io/hyperkitty/list/ceph-users@ceph.io/thread/LN2Y34QFW3KE4TUZG7QNBQD5NQ5L2E6S/
• https://lists.ceph.io/hyperkitty/list/ceph-users@ceph.io/thread/2MVUA6UH33KOMJHO3VSBOCWFR6AI6H5Y/
• https://lists.ceph.io/hyperkitty/list/ceph-users@ceph.io/thread/7XUTSYMQUDNBKSH7RSGW2GQDDZUUPVDV/

I wrote a script that handles the key rotation for service daemons (minus mons -- see the doc for those), if anyone else finds it useful:

(you need to change how $id is generated, if you don't use the local node hostname)

#!/bin/zsh

TD=$(mktemp -d) ; trap 'rm -rf $TD' EXIT
T=$TD/scratch
S=~/ceph-auth-rotate.state.d

say()
{
    local fmt=$1; shift;

    if (( $# > 0 )); then
        printf -- "$fmt" "$@" >&2
    else
        printf -- '%s\n' "$fmt" >&2
    fi
}

die()
{
    local code=$1
    say "$@"

    exit $code
}

_state_set()
{
    local ns=$1 name=$2 state=${3:-}

    mkdir -p $S/$ns 2>/dev/null
    touch $S/$ns/$name${state:+.$state}
}

_state_get()
{
    local ns=$1 name=$2 state=${3:-}

    test -f $S/$ns/$name${state:+.$state} && return 0 || return 1
}

_osd_ids()
{
    if ceph-volume lvm list --format=json | jq --exit-status -r '(keys | .[]) // null' >$T; then
        cat $T; else; return 1;
    fi
}

_osd_lv_path()
{
    local id=$1

    ceph-volume lvm list $id --format=json | jq --exit-status -r --arg id $id '.[$id][0].lv_path'
}

_hostname()
{
    hostname -s
}

_rekey_ceph_svc()
{
    local svc=$1 id=$2 is_osd=0
    local state=/var/lib/ceph/${svc}/ceph-${id}
    [[ $svc == "osd" ]] && is_osd=1

    if _state_get $svc $id; then
        say "$svc-$id was already rekeyed, skipping"
        return 0
    fi

    if ! test -d $state; then
        say 'unable to find state dir for %s-%s -- skipping\n' $svc $id
        return 0
    fi

    if ! test -f $state/keyring; then
        die 1 "No keyring for %s-%s in found '%s'\n" $svc $id $state
    fi

    say "Rekeying $svc-$id..."
    systemctl stop ceph-${svc}@${id}.service

    (( is_osd > 0 )) && ceph osd down $id

    if ! _state_get $svc $id rekey; then
        if ceph auth rotate --key-type=aes256k $svc.$id >$T; then
            cat $T > $state/keyring

            _state_set $svc $id rekey
        fi
    fi

    if ! _state_get $svc $id devlabel; then
        if (( is_osd > 0 )); then
            local lvpath=$(_osd_lv_path $id)

            ceph-bluestore-tool --dev $lvpath set-label-key --key osd_key -v "$(rg -F key $state/keyring | awk '{print $3}')"
            _state_set $svc $id devlabel
        fi
    fi

    systemctl restart ceph-${svc}@${id}.service

    _state_set $svc $id

    return 0
}

main()
{
    set -euo pipefail
    local id=$(_hostname)

    say "=== Rekeying Ceph Services ($id) ==="
    _rekey_ceph_svc mgr $id || die 1 "failed to rekey mgr-$id"
    sleep 2
    _rekey_ceph_svc mds $id || die 1 "failed to rekey mds-$id"
    sleep 2

    local osd_ids=( $(_osd_ids || :) )
    for osd_id in "${osd_ids[@]}"; do
        _rekey_ceph_svc osd $osd_id || die 1 "failed to rekey osd-$osd_id"
        sleep 2
    done

    return 0
}

main "$@"

As the AUR is closed right now due to malware, I cannot push the update for v20.2.3-1.

This release includes a fix for a slow memory leak in the mgr, plus all the stuff mentioned in: https://ceph.io/en/news/blog/2026/v20-2-3-tentacle-released/#notable-changes

You may find (and build) it yourself at https://github.com/bazaah/aur-ceph/tree/release/v20.2.3

I do also publish my Ceph packages to an (internal focused) repository, which you can use, but fair warning: this repo is updated as and when the needs of my personal infra dictate.

# Requires:
#   pacman-key --recv-key AA2F58D04E59C080 --keyserver keyserver.ubuntu.com
#   pacman-key --lsign-key AA2F58D04E59C080
#   pacman -U https://storage.st8l.com/archlinux/ceph/os/x86_64/st8l-keyring-1.0.0-1-any.pkg.tar.zst
[ceph]
Server=https://storage.st8l.com/archlinux/repo/$repo/os/$arch

Could you please also add

-DLUA_INCLUDE_DIR=/usr/include/lua5.3 \
-DLUA_LIBRARIES=/usr/lib/liblua5.3.so \

to the cmake clause in build()? This prevents cmake from picking up other Lua versions in case any are installed.

Also, it seems that Lua5.4 also works (though Lua5.5 breaks).

I should have a gcc 16 fix out sometime today or early tomorrow

https://gist.github.com/bazaah/c043ece021141553226dc3d475c0137c (grep -F heap_profiler on line 708)

(as the builder)

[builduser@ceph-build-test aur.ceph]$ cat ~/.bash_history
git clone --branch=feature/v20.2.1-3 https://git.st8l.com/luxolus/aur.ceph.git
cd aur.ceph
pkgctl build

(as root)

[root@ceph-build-test aur.ceph]# cat ~/.bash_history
ip a
ip a
ip a
ip a
ip a
ip a
pacman -S devtools git curl
useradd -h
useradd -d /var/lib/builduser -m -U builduser
passwd builduser
sudoedit /etc/sudoers.d/50-builduser
sudo su - builduser
grep -F heap_profiler /var/lib/archbuild/extra-x86_64/builduser-2/logdest/ceph-20.2.1-3-x86_64-build.log
less /var/lib/archbuild/extra-x86_64/builduser-2/logdest/ceph-20.2.1-3-x86_64-build.log

The build still fails much later when trying to link some rgw tests -- pretty sure my backport rebase is wrong.

@pbazaah: I can replicate both locally and on the arch build server.

==> try running just pkgctl build.

@daurnimator is there a way you can tar up your chroot and send it to me? I've started a new arch container and built the chroots from scratch and still can't reproduce that build error

I was able to get past that error with this patch:

--- a/src/common/Formatter.h
+++ b/src/common/Formatter.h
@@ -5,13 +5,14 @@

 #include "include/buffer_fwd.h"

+#include <cstdarg>
+#include <cstdint>
 #include <deque>
 #include <fstream>
 #include <functional>
 #include <list>
 #include <memory>
 #include <vector>
-#include <stdarg.h>
 #include <sstream>
 #include <map>
 #include <vector>

But then it fails with the same old error:

[119/2722] Building CXX object src/perfglue/CMakeFiles/heap_profiler.dir/heap_profiler.cc.o
FAILED: [code=1] src/perfglue/CMakeFiles/heap_profiler.dir/heap_profiler.cc.o 
/usr/bin/c++ -DBOOST_ASIO_DISABLE_THREAD_KEYWORD_EXTENSION -DBOOST_ASIO_HAS_IO_URING -DBOOST_ASIO_NO_TS_EXECUTORS -DHAVE_CONFIG_H -D_FILE_OFFSET_BITS=64 -D_GNU_SOURCE -D_REENTRANT -D_THREAD_SAFE -D__CEPH__ -D__STDC_FORMAT_MACROS -D__linux__ -I/build/ceph/src/ceph-20.2.1/build/src/include -I/build/ceph/src/ceph-20.2.1/src -isystem /build/ceph/src/ceph-20.2.1/build/include -isystem /build/ceph/src/ceph-20.2.1/src/xxHash -isystem /build/ceph/src/ceph-20.2.1/src/fmt/include -march=x86-64 -mtune=generic -O2 -pipe  -fexceptions         -Wp,-D_FORTIFY_SOURCE=3 -Wformat -Werror=format-security         -fstack-clash-protection -fcf-protection         -fno-omit-frame-pointer -mno-omit-leaf-frame-pointer -Wp,-D_GLIBCXX_ASSERTIONS -g -ffile-prefix-map=/build/ceph/src=/usr/src/debug/ceph -Wno-maybe-uninitialized -O2 -g -DNDEBUG -std=c++20 -fPIC -fno-builtin-malloc -fno-builtin-calloc -fno-builtin-realloc -fno-builtin-free -Wall -fno-strict-aliasing -fsigned-char -Wtype-limits -Wignored-qualifiers -Wpointer-arith -Werror=format-security -Winit-self -Wno-unknown-pragmas -Wnon-virtual-dtor -Wno-ignored-qualifiers -ftemplate-depth-1024 -DBOOST_ALLOW_DEPRECATED_HEADERS -Wpessimizing-move -Wredundant-move -Wstrict-null-sentinel -Woverloaded-virtual -fstack-protector-strong -fdiagnostics-color=auto -MD -MT src/perfglue/CMakeFiles/heap_profiler.dir/heap_profiler.cc.o -MF src/perfglue/CMakeFiles/heap_profiler.dir/heap_profiler.cc.o.d -o src/perfglue/CMakeFiles/heap_profiler.dir/heap_profiler.cc.o -c /build/ceph/src/ceph-20.2.1/src/perfglue/heap_profiler.cc
/build/ceph/src/ceph-20.2.1/src/perfglue/heap_profiler.cc: In function ‘void get_profile_name(char*, int)’:
/build/ceph/src/ceph-20.2.1/src/perfglue/heap_profiler.cc:102:48: error: ‘class ConfigValues’ has no member named ‘log_file’
  102 |   snprintf(path, sizeof(path), "%s", g_conf()->log_file.c_str());
      |                                                ^~~~~~~~