Proxmox VE 9.2.9 → 9.2.24
15 releases · 3 breaking changes · 0 security fixes · 0 advisories fixed
0security3breaking0deprecated22feature19fix
Breaking changes
- breaking fix #4986: jobs: schedule a job again if the task log of its last run is missing, for example after a crash. Previously the job was skipped with 'could not update job state, skipping - no such task' on every scheduler iteration until its state file was removed manually. in 9.2.22
- breaking ask for the checks that prove an OSD is gone before its leftover lockbox key is removed, and no longer suggest removing the authentication entry of a daemon that only seems gone in 9.2.15
- breaking api: ceph: mds: deprecate hotstandby parameter in the API schema, and do not set the mds_standby_for_name and mds_standby_replay config options any more, they were removed in Ceph 14.1 and setting them has no effect any more in 9.2.10
Security changes
None in the release notes.
Every release in between
9.2.24 Oct 23, 2026
otherapi: node shell: harden the console against crafted parameters by only passing the known Ceph version and repository options to the command of the Ceph installation wizard, rejecting any other parameter.
fixui: consent banner: fix loading the web interface when the consent text contains a single quote, which broke the JavaScript of the page. This only affected texts set outside the web interface, for example through the API, as the web interface stores them base64-encoded.
9.2.23 Oct 19, 2026
featureceph: add Ceph 21.2 Umbrella as an experimental release, which 'pveceph install' and the installation wizard offer for testing. This also lets the wizard recognize a cluster that already runs Umbrella when adding a node, instead of reporting that it found no Ceph installation.
otherceph: OSD flags: offer the 'noautoscale' flag, which pauses the PG autoscaler for all pools. This helps during maintenance and upgrades, for example to Ceph 21 Umbrella, which doubles the autoscaler's target of PGs per OSD and could otherwise start splitting PGs while daemons of both versions run.…
otherceph: rolling restart: let a missing active manager (MGR_DOWN) only block OSD restarts, as only their safety check needs the manager. During an upgrade, managers still running the old version can stop reporting to the upgraded monitors, which left no manager active and blocked restarting the…
otherceph: rolling restart: do not let BLUESTORE_BLUEFS_OVERSIZED warnings block. Ceph 21 Umbrella OSDs can raise this space usage advisory right after their upgrade, which made the restart refuse every further node unless forced.
otherapi: resource pools: require the Pool.Audit privilege on a pool when querying it with 'GET /pools?poolid='. The permission was checked, but its result was ignored, so any user could list the members of every pool.
otherapi: network: reject line breaks in the OVS options of an interface, as the value is written as is into /etc/network/interfaces.
featureui: ceph: service list: allow restarting a monitor, manager or MDS shown as stopped. The shown state comes from the cluster, so a daemon whose service runs but does not report in, such as a manager not reporting to upgraded monitors, only offered Start, which did nothing.
otherceph: Cephx key migration: support Ceph daemons on hosts outside this Proxmox VE cluster, such as the tiebreaker monitor of a stretch cluster. Previously, such a monitor made the helper refuse staging client keys and switching the service cipher, and made the monitor key rotation fail:
otherquery such monitors with 'ceph tell' instead of over SSH
otherjudge their cipher support by the version they run, and refuse if they are not reported as running
otherrotate the 'mon.' key without writing their keyring or restarting them, print the commands to refresh their emergency keyring, and check that they remain in the quorum
otherwarn about key copies such hosts keep for their own use, for example of 'client.admin', and print the commands to refresh them
9.2.22 Oct 15, 2026
fixfix #8015: ui: upload and download from URL: let the user choose the format of '.img' images for import content, instead of always treating them as raw images. The '.img' extension is also used for other formats, for example by the qcow2 based Ubuntu cloud images, which were imported as raw disks…
fixfix #6475: ui: upload: show only the name of the selected file, instead of the 'C:\fakepath\' path that browsers report on every platform.
fixfix #5608: ui: resource mappings: validate the names of PCI, USB and directory mappings like the API does, so that an invalid name is marked right away with a hint about the allowed characters, instead of failing with a generic error on submit.
fixfix #7108: ui: firewall: IPSet: do not offer aliases that are already part of the IPSet, as adding them again only fails with an 'already exists' error.
otherui: container features: drop the 'Experimental' label from the 'Create Device Nodes' option, as the feature is considered stable.
otherui: SDN: zone edit: opening the dialog no longer marks the DNS server fields as changed, which enabled the reset button and allowed submitting an unchanged form.
fixfix #6735: api: PCI: allow listing the mediated device types of a PCI mapping with Mapping.Use, Mapping.Modify or Mapping.Audit on that mapping. Previously Sys.Audit or Sys.Modify on '/' was required, so other users could not choose a mediated device type for a mapped PCI device.
otherapi: node status: return the idle time from /proc/uptime as 'idle', which was always 0, and document 'idle' and 'uptime' in the return schema, so that generated API clients can access them.
breakingfix #4986: jobs: schedule a job again if the task log of its last run is missing, for example after a crash. Previously the job was skipped with 'could not update job state, skipping - no such task' on every scheduler iteration until its state file was removed manually.
fixfix #8093: pvestatd: drop the periodic cleanup of stale container consoles, which queried the status of every running container a second time in each update cycle, an overhead growing with the number of containers. Consoles exit on their own when their container stops; the cleanup only mattered in…
featureceph: create the keyrings of new MDS and manager daemons and the OSD bootstrap keyring with mode 0600 instead of 0644, as their keys can access every pool or register OSDs. Before, only the 0750 /var/lib/ceph directory kept other local users out. Existing keyrings are not changed.
fixfix #8163: ceph: pool create: pass the CRUSH rule of replicated pools to Ceph on creation, instead of setting it afterwards. Ceph checks the 'mon_max_pg_per_osd' limit against the rule a pool is created with, so a pool with a non-default rule could be refused because the OSDs of the default rule…
fixfix #8046: ui: ceph: fix muting a health check with 'No expiry', which the API rejected with an invalid 'ttl' error.
fixfix #8098: ui: ceph: OSD: sort the OSD tree naturally by name, so that osd.10 comes after osd.8 and a host pve10 after pve2.
otherceph: Cephx key migration: state plainly in the closing summary that no authentication health error remains, as the previous wording was read as something still left to do.
otherpve8to9: warn if the EFI System Partition (ESP) of a UEFI system is not mounted at /boot/efi, as the system may then fail to boot after the GRUB update of the upgrade. Systems using proxmox-boot-tool are skipped, as it mounts the ESPs itself.
9.2.21 Sep 24, 2026
otherui: VM CD/DVD drive: change the medium through an API task, so that its warnings, for example about problematic VirtIO driver ISO versions, are shown.
featureui: pool selector: allow typing to search, which helps with many pools.
otherbackup: extracting the configuration of a backup that belongs to no guest, for example a host backup on Proxmox Backup Server, now fails with a clear error instead of also printing a Perl warning.
otherceph: OSD destroy: also remove the lockbox key and the dm-crypt key of an encrypted OSD. Both were left behind in the monitors, and the lockbox key then showed up as an insecure key during the Cephx key migration.
otherceph: FQDN host names: count outdated OSDs on nodes whose host name is an FQDN for the OSD rolling restart, which previously reported nothing to do, and show one entry per service in the daemon metadata.
otherceph: Cephx key migration:
othersupport nodes whose host name is an FQDN; previously every run that judged service daemons was refused, and node commands now only run on cluster members
otherrefuse to retire a key that a storage key copy still holds, for example that of a storage naming the local monitors through 'monhost', whose copy the helper does not update; the plan names such copies
otherretry the monitor session query after the migration's own monitor elections, instead of refusing the cipher restriction because not every monitor answered, and likewise for the summary after a run
othercheck libpve-storage-perl, librados2, and librbd1 on every node using a key before staging it, including nodes that only run guests
featurerefuse client key changes if the monitors do not accept Cephx from clients, as a new storage key file would then break that storage
otherrefuse rotating the shared monitor key below three monitors, where the rolling monitor restart cannot keep quorum
otherdetect an unreadable monitor key in the dry run instead of failing during the apply run
othername orphaned lockbox keys and stale service entries as what blocks the final step, with the removal commands to use after verification
featureallow rerunning the final confirmation command when nothing is left to confirm
othername guests with an ISO or bind mount on a CephFS mount that blocks the key refresh
otherwrite the lockbox key tag of encrypted OSDs through the LVM shell instead of an embedded Python helper
otherclarify guidance: live migration also refreshes kernel RBD disks, so only containers on RBD need a restart; the rotating service key warning does not need to clear first; say 'client' instead of 'consumer'
otherd/control: require libpve-storage-perl 9.1.9 or newer, which accepts keyrings holding an aes256k key; older versions leave RBD and CephFS storages that use a migrated key inactive.
9.2.20 Sep 11, 2026
featureRevert "partially fix #1989: ui: qemu: disk: add qcow2 cache size config"
otherthe corresponding qemu-server changes are not yet rolled out
9.2.19 Sep 9, 2026
fixpvesh: fix startup failure caused by API endpoints with empty parameter schemas, such as 'pvesh get /cluster/firewall/options'.
otherceph: Cephx key migration:
featurerefuse staged-key confirmation when a visible client's key cannot be identified, rather than treating a new session as proof of refresh
otherkeep device inspection errors concise without hiding short failure reasons; retain full diagnostics with '--verbose'
featureallow recovery once nodes are reachable, even if daemons with unfinished key updates remain stopped, without assuming their keys need repair
otherseparate unidentified monitor sockets from VM hints to avoid implying that a VM uses a kernel client
otherexplicitly report successful dry-run preflight checks, retaining a warning when '--force' was used
9.2.18 Sep 6, 2026
otherceph: Cephx key migration:
otherprevent client-key retirement or recovery changes before consent
otheravoid unnecessary client reconnects and CephFS remounts caused by monitor elections or older migration records
otherclarify remaining refresh steps and identify affected nodes and mounts
otherceph: auth status:
othershow compact key summaries and next steps for pending keys, service tickets, and kernel compatibility
othermark unavailable data as unknown and distinguish cipher defaults from authentication permissions
9.2.17 Sep 5, 2026
otherceph: Cephx key migration:
featureadd '--rotate-all-storage-keys' to rotate dedicated users of local RBD and CephFS storages together, excluding external clusters and keeping 'client.admin' a separate choice
otherrefuse administrative and storage-user key rotation if any monitor cannot keep both keys valid while consumers refresh
otherkeep both keys valid during rollback until consumers return to the restored key and the operator confirms with '--confirm-abort-clients-refreshed'
otherdetect returning old-key consumers using monitor session fingerprints and recheck consumers before retiring keys or invalidating tickets
otherrefresh CephFS mounts without forced or lazy unmounts; retry busy mounts on a later apply run
otherleave pending daemon keys untouched when their ownership is unclear, and wait for monitor elections to finish before staging
fixcomplete bootstrap and crash key rotations without asking operators to confirm refreshes for Ceph's own tools
featuremake new keys use the new cipher before disabling the old cipher
othershow next steps based on current keys and settings, with concise consumer hints, storage inventories, and recovery instructions
otherceph: auth status: show current and pending key ciphers without exposing secrets, and lead with the next migration command.
9.2.16 Sep 3, 2026
otherceph: Cephx key migration:
featurestage eligible 'client.admin' and storage-user keys while their current keys remain valid, so consumers can refresh before the new key is committed. This requires Ceph 19.2.6-pve3, 20.2.4-pve3, or newer on every monitor; with an older monitor, replace the keys at once as before
otherjournal staged rotations so interrupted work resumes safely; if monitor support disappears, require completion or '--abort-staged-key' instead of falling back to immediate replacement
otherconfirm refreshed consumers per Ceph user or for all ready rotations at once. Refuse confirmation while a recorded consumer is still connected or a monitor did not answer the session query; refuse the all-at-once form entirely if any rotation is not ready
fixadd '--rotate-cluster-keys' as the concise path for the shared 'mon.', bootstrap, crash, and encrypted OSD lockbox keys
otherbefore replacing a Ceph user key at once, tell operators to stop every consumer because its next reconnect can fail immediately
otherprint concise plans by default with affected Ceph users, disruptive steps, warnings, and next commands; provide full inventories with '--verbose'
otheravoid duplicate notices and spurious unfinished records for Ceph user keys rotated by an earlier version of the helper
otherui: ceph: distinguish Cephx migration checks from availability and data health failures, show check-specific next steps, and link to the local documentation
9.2.15 Sep 2, 2026
fixfix #7896: ui: qemu: show the effective implicit machine version for Windows guests and avoid accidentally pinning a fallback when changing other machine settings
otherceph: cephx key migration:
othername the running consumers of every client key a run rotates, and report the recorded consumers that may still hold a replaced key and could fail on a reconnect or ticket expiry
otherconfirm a rotation only for the consumers a run cannot see: the confirmation is refused while a recorded consumer is connected, and an unmeasured rotation is measured first
featureadd --restrict-ciphers to drop the old cipher as a guarded final step, refused while any key depends on it or a recorded consumer may still do so
otherrefuse a rotating-key wipe while a recorded client may still hold a replaced key, and mark the wipe as not recommended, as it invalidates every service ticket and requires all clients and daemons to support aes256k
otheroffer the options that are still open as one command to paste, so the finish of the migration is visible
featureredo the mount of every CephFS storage whose key a run rotates, on each node, so it starts a fresh client with the new key; a mount that is in use is named rather than pulled away, and one that stopped answering is force-unmounted, which frees the processes blocked in it
otherrefuse to rotate a storage key while a pending key is staged for it, as that key would replace the fresh one on its first use and leave the storage copies mismatched
otherfail a run when a node stops answering instead of waiting forever
othersay that the service ticket switch and the cipher restriction make the monitors hold an election, a few seconds in which they do not answer
otherpoint at the independent monitor identity when the admin keyring no longer matches the cluster, instead of a bare permission error
otherignore data directories left by removed or destroyed OSDs while continuing to block existing OSDs without an authentication entry
otheridentify a stopped OSD device by its per-OSD UUID and refuse duplicate data directories, so a reused ID cannot direct a key write at old data
fixvalidate lockbox values as cephx keys rather than accepting any base64 data, and redact lockbox keys from LVM error output to keep them out of task logs and bug reports
breakingask for the checks that prove an OSD is gone before its leftover lockbox key is removed, and no longer suggest removing the authentication entry of a daemon that only seems gone
otherceph: osd: on destroy, remove the empty mount-point directory and the runtime unit enablement ceph-volume left behind, so the OSD stops being reported as a configured service before the next boot
9.2.14 Aug 28, 2026
otherceph: cephx key migration:
otherstop reporting an abort that never happened at the end of every apply run, which the lock heartbeat printed when the run released it
othernever remove the lockbox tag of an encrypted OSD when asked to write the key it already holds, and refuse a value that is not a key, so a mistake cannot leave that OSD unable to unlock
9.2.13 Aug 28, 2026
featurepartially fix #1989: ui: qemu: allow configuring the qcow2 cache size when creating or editing a disk, either directly or derived from the disk size, which can improve performance considerably for some guests
otherapi: apt: accept the HTTP proxy as a URI, so that a password can contain special characters
otherceph: cephx key migration:
featureadd '--rotate-lockbox-keys' to migrate the 'client.osd-lockbox' key of an encrypted OSD. That key lives in the authentication database and in an LVM tag on the OSD's block device that ceph-volume rebuilds the keyring from, so rotating only the entry left the OSD unable to unlock, and recreating it…
otherlist the options that are still open when a run finishes, so that ending the migration does not mean looking up which key groups are left
otherrecover the admin keyring through the 'mon.' credential when a run was interrupted while rotating 'client.admin', which left the cluster without a usable admin key before
othercommit rather than drop a pending key when a live key swap was interrupted after the key reached the bluestore label, as the OSD data directory is rebuilt from that label at boot
otherplan a newer interrupted rotation of an entity even if an older run finished one, for example after a key reset by hand or a reused OSD id
otherrequire every monitor in quorum only for a monitor key rotation, so a cluster with one monitor down can still migrate its daemon keys
otherreport daemons and nodes whose Ceph version or kernel could not be verified apart from those known to be outdated
otherrestore 'auth_preferred_cipher' also when a run fails, and refuse to continue over an unknown recorded value instead of dropping it
otherhold a second apply run on any node back through a lock on the cluster file system, and take the node's bulk restart lock as well, so that a rolling restart from the web interface cannot start there meanwhile
otherrecord which OSDs a run sets 'noout' on before setting it, so that a hard kill in between cannot leave the flag without a record to clean up from
featurerotate the standby managers before the active one, so that a failover lands on a manager that already carries the new key
otherreport whether an authentication check is still an error from what the run itself confirmed, as the monitors recompute on their own tick
othercut the output of a run down to what decides whether to proceed
9.2.12 Aug 22, 2026
fixfix #7136: ui: tree: harmonize folder view resource ordering
fixfix #6113: ui: import: allow selecting a resource pool when importing a guest from an OVA file or from VMware ESXi
otherceph: rolling restart:
featureallow a restart on a cluster whose only errors are the cephx cipher health checks that Ceph 19.2.6 and 20.2.4 raise. Those made every upgraded cluster report HEALTH_ERR, which blocked every rolling restart, so one could not be finished and left daemons on mixed versions
otherjudge each health check on its own severity instead of on the overall cluster status
otherignore health checks that Ceph itself has muted
otherevaluate the OSD map flags only for an OSD restart, as they do not affect monitor quorum, manager failover or MDS takeover. A 'nodown' set to stop OSDs from flapping no longer blocks a monitor restart
otherreport per daemon type whether a check blocks a restart, so the web interface only warns about what applies to the restart at hand
otheronly clear the 'noout' flags the restart set itself. A flag an operator had set on a single OSD, to stop it flapping or while working on its disk, was cleared as soon as any rolling restart finished
featureceph: allow muting and unmuting a health check from the web interface and the API. A muted check is still evaluated and reported, but it no longer counts towards the overall cluster status. That is the only answer for a check that cannot be acted on, and it was previously only possible on the…
featureceph: add 'pveceph auth status', a read-only report on which cephx keys still use the old cipher, whether they can be migrated yet, and what is holding that up, including the kernel version of every node.
fixceph: add a guided helper to migrate the cephx service keys to the aes256k cipher: /usr/share/pve-manager/migrations/pve-cephx-rotate-service-keys It goes through the daemons of the whole cluster one at a time and can be narrowed to a single daemon type or a single daemon. It runs as a dry run…
otherpve8to9: name the cephx key migration health checks instead of asking to resolve them, as an upgraded cluster reports its unmigrated keys as insecure and the client keys cannot be migrated at all on a Bookworm kernel.
fixfix #7927: ui: sdn prefix-lists: change the prefix format to allow bigger subnets, covering the full CIDR prefix range including 0.0.0.0/0.
9.2.11 Aug 14, 2026
otherui: certificates, lxc DNS, VM cloud-init and PCI: encode rendered values with htmlEncode.
featureui: acme: use improved URL rendering implementation from proxmox-widget-toolkit.
9.2.10 Aug 7, 2026
otherpveperf: make bogomips regular expression case insensitive, other architectures like Loong64 use different capitalization
otherui: LXC templates: hide foreign architectures by default, arm64 and amd64 look very similar and can be easily confused
otherui: appliance templates: rename the "Package" column to "Name"
featureui: LXC templates: add a search hint to the "download" dialogue and widen the search input field
breakingapi: ceph: mds: deprecate hotstandby parameter in the API schema, and do not set the mds_standby_for_name and mds_standby_replay config options any more, they were removed in Ceph 14.1 and setting them has no effect any more