mgr/dashboard: fix notification re-navigation when already on page
When a notification is clicked in the panel while the user is already
on the notifications page, the selected notification now updates
correctly by bypassing the preselect guard for query param changes.
mgr/dashboard: Sanitize toast HTML and optimize notification service
- Escape user-controlled content before Carbon innerHTML rendering
- Whitelist localStorage deserialization keys, prune stale read map
- Replace deep equality with ID comparison in removeToast
- Gate ngAfterViewChecked DOM queries behind a dirty flag
- Deduplicate by title+type+message; show occurrences count
- Fix bell icon unread dot clearing on new occurrences
- Fix view more pre-selection via route queryParams observable
- Save individual notifications instead of HTML-merged messages
- Convert notifications bell component to signals with OnPush
- Add OnPush to notification-item and toast components
- Add e2e tests
- Fix styling of notification panel
- adds view more link to toast which takes to view full toast message
- allow notifications to be clickable in notification panel taking user to the particular notification
- add routes to eahc notitification in notificatio page
- extend duration for error notifications - as per carbon error notifications should persist longer since users need time to read
mgr/dashboard: set MOTD fails on FIPS enabled systems
Root cause: On FIPS-compliant systems, the OpenSSL provider rejects hashlib.md5() calls that lack the usedforsecurity=False flag, because MD5 is not an approved algorithm for security-sensitive use. This causes the MOTD set command — and the /api/motd create endpoint — to raise a ValueError and crash whenever a new MOTD is saved.
Fix: Pass usedforsecurity=False to hashlib.md5(). This tells the FIPS provider that MD5 is being used only as a non-cryptographic checksum (to detect whether a user has already dismissed a specific MOTD message), which is a legitimate use-case that FIPS allows.
* refs/pull/52147/head:
PendingReleaseNotes: add an note about dmclock based scheduler for MDS
doc/config-ref: mention about MDS dmclock configurations
qa: use dmclock with fs:workload
mds: add MDS dmClock scheduler for subvolume QoS support
Reviewed-by: Venky Shankar <vshankar@redhat.com> Reviewed-by: Robin H. Johnson <robbat2@orbis-terrarum.net>
David Galloway [Fri, 17 Jul 2026 18:34:44 +0000 (14:34 -0400)]
container: default FROM_IMAGE to Rocky Linux 10
Since tentacle, the preferred base image for ceph containers has been
Rocky Linux 10, and the CI tag-naming logic in build.sh already assumes
rockylinux-10 is the default fromtag for every branch except reef and
squid. The actual build default was never flipped, though: anything
that ran build.sh without FROM_IMAGE set (e.g. the release container
job in ceph-build) still got a CentOS Stream 9 base.
Flip the Containerfile ARG and the build.sh fallback to
docker.io/rockylinux/rockylinux:10 so umbrella and later build from
Rocky 10 by default. Builds that want a different base can still pass
FROM_IMAGE explicitly, as the CI pipeline does.
Signed-off-by: David Galloway <david.galloway@ibm.com>
Aggressive Link-Time Optimization (LTO) and stricter linker defaults
in newer toolchains (like GCC 13 on Ubuntu 24.04) can strip or
localize external global variables if their visibility is not
explicitly defined. Tagging g_lockdep with default visibility ensures
it remains accessible in the dynamic symbol table for external
binaries like monmaptool.
Assisted-by: Gemini Fixes: https://tracker.ceph.com/issues/78321 Signed-off-by: Patrick Donnelly <pdonnell@ibm.com>
Devika Babrekar [Mon, 15 Jun 2026 11:17:16 +0000 (16:47 +0530)]
mgr/dashboard:EC Profile creation form simplification and improvement Fixes: https://tracker.ceph.com/issues/77369 Signed-off-by: Devika Babrekar <devika.babrekar@ibm.com>
Conflicts:
src/pybind/mgr/dashboard/frontend/src/app/ceph/pool/erasure-code-profile-form/erasure-code-profile-form-modal.component.html
-removed Directory field, as it is no longer needed in form
Devika Babrekar [Mon, 22 Jun 2026 14:53:17 +0000 (20:23 +0530)]
mgr/dashboard: Disable multisite Action dropdown for read-only user Fixes: https://tracker.ceph.com/issues/77570 Signed-off-by: Devika Babrekar <devika.babrekar@ibm.com>
Conflicts:
src/pybind/mgr/dashboard/frontend/src/app/ceph/rgw/rgw-multisite-details/rgw-multisite-details.component.html
- added disabled property on table component to disable the table
src/pybind/mgr/dashboard/frontend/src/app/shared/datatable/table-actions/table-actions.component.html
- added disabled property on table component to disable the table
crimson/os/seastore/transaction: new conflict/no_conflict trans
synchronization
Use seastar::shared_mutex to synchronize transactions when committing
no_conflict ones.
Specifically, this commit achieves conflict/no_conflict trans
synchronization by:
1. The no_conflict trans acquires locks on all the stable extents which
it modifies.
2. The conflicting trans acquires shared locks on all the stable extents
which it modifies.
3. The no_conflict trans releases the locks after its committing.
4. The conflicting trans releases the shared locks once it enter the
prepare pipeline phase.
This commits makes sure that:
1. only transactions accessing the extents that the no_conflict trans
is committing will be blocked.
2. avoid persisting extents that a committing no_conflict trans is
modified
Compared to the old approach, this commit's strategy is much more
straightforward and understandable.
This commit is more performant as the no_conflict trans only blocks
the trans the modified extent set of which intersects with it, while,
in the old approach, all other transactions will be blocked once a
conflicting trans is blocked because it's blocked after it enters the
prepare pipeline phase
Anoop C S [Wed, 15 Jul 2026 18:41:13 +0000 (00:11 +0530)]
cephadm/smb: Update CTDB bind mount for new socket path
Samba recently changed CTDB to derive its runtime paths from Samba's
configure options instead of using a monolithic CTDB_RUNDIR[1].
With current packaging[2], the CTDB socket path moved from
/var/run/ctdb/ctdbd.socket to /run/samba/ctdb/ctdbd.socket.
Update the CTDB runtime bind mount target from /var/run/ctdb to
/run/samba/ctdb to match the new CTDB_SOCKETDIR. Additionally,
create the CTDB pid directory, /run/ctdb, and lock directory,
/var/lib/samba/lock/ctdb, on the host side as they are hidden
when their parent directories are bind mounted over.
Ideally these directories should be created by sambacc but sambacc is
included in samba-container images that may be built with different
Samba packages where these path configurations might not hold true.
Kefu Chai [Fri, 23 Jan 2026 07:04:47 +0000 (15:04 +0800)]
debian/rules: exclude ceph-osd-crimson from dwz compression
When building with DWZ enabled, the debian packaging fails with:
```
dh_dwz: error: Aborting due to earlier error
```
Running the dwz command manually reveals the root cause:
```
$ dwz -mdebian/ceph-osd-crimson/usr/lib/debug/.dwz/x86_64-linux-gnu/ceph-osd-crimson.debug \
-M/usr/lib/debug/.dwz/x86_64-linux-gnu/ceph-osd-crimson.debug -- \
debian/ceph-osd-crimson/usr/bin/ceph-osd-crimson \
debian/ceph-osd-crimson/usr/bin/crimson-store-nbd
dwz: debian/ceph-osd-crimson/usr/bin/ceph-osd-crimson: Too many DIEs, not optimizing
dwz: Too few files for multifile optimization
```
The dwz tool has a limit on the number of DWARF DIEs (Debug Information
Entries) it can process. The ceph-osd-crimson binary, being a large C++
executable with extensive template usage, exceeds this limit, causing
dwz to exit with status 1 and fail the build.
This change excludes only ceph-osd-crimson from dwz processing using
the -X flag, allowing other binaries in the package to still benefit
from DWARF compression while avoiding the build failure.
Please note, we always disable DWZ in ceph-build's ceph-dev-pipeline.
sujay-d07 [Fri, 12 Jun 2026 08:23:59 +0000 (13:53 +0530)]
qa/rgw: Adding GSSAPI testing task for Bucket Notification Testing
This adds a Kerberos setup task, tells the Kafka task to emit GSSAPI listeners and broker principals, and updates notification tests to pass Kerberos credentials through to the bucket-notification suite. It enables the RGW Kafka notification coverage to run against GSSAPI-secured brokers.
* refs/pull/68813/head:
tools/cephfs: make journal pointer/header failure explicit
doc/cephfs: add note explainin the new batching technique
tools/cephfs: document --max-rss usage in first-damage.py
qa: test cephfs-journal-recovery event recover_dentries summary
tools/cephfs: flush every journal event as soon as it is scanned
Reviewed-by: Venky Shankar <vshankar@redhat.com> Reviewed-by: Patrick Donnelly <pdonnell@ibm.com>
projects / ceph.git / log